In September 2025, California fined the nation's largest rural lifestyle retailer $1.35 million for CCPA violations. A month later, Sling TV settled for $530,000 over failures to properly handle opt-out requests. Throughout 2025, the California Attorney General launched 47 formal enforcement actions under CCPA, with an estimated 300 additional informal resolutions happening quietly behind the scenes.
California isn't slowing down. On January 1, 2026, new regulations take effect that specifically address AI and automated decision-making technology. If you're using ChatGPT with any data belonging to California residents, these rules apply to you.
The question isn't whether California will enforce privacy laws against AI companies. The question is whether your organization will be caught in the crossfire.
The short version: If you need to redact sensitive documents before they reach AI systems, PaperVeil handles that layer. The rest of this article explains where it fits in the broader governance architecture.
The Direct Answer: Is ChatGPT CCPA Compliant?
OpenAI states they're "committed to complying with the California Consumer Privacy Act." They claim they don't "sell" personal data or "share" it for cross-contextual behavioral advertising as those terms are defined under California law. They provide mechanisms for California residents to exercise their privacy rights.
But here's what matters for your business: OpenAI's compliance posture doesn't automatically make your use of ChatGPT compliant. When you upload data containing California residents' personal information to ChatGPT, you become the data controller responsible for that processing activity. OpenAI's policies govern what they do with the data. Your policies and procedures govern whether the transfer itself was lawful.
For consumer ChatGPT (Free, Plus, Pro): The data you submit can be used to train OpenAI's models unless you manually disable this in Settings > Data Controls. Even with training disabled, your data transmits to OpenAI's servers, gets processed, and is retained for safety monitoring. This means you're transferring personal information to a third party, which triggers CCPA obligations around disclosure and consumer rights.
For ChatGPT Business, Enterprise, and API: OpenAI doesn't use this data for training by default. These tiers offer more robust privacy controls, including a Data Processing Addendum. But the fundamental issue remains: you're still the controller, and you're still responsible for ensuring the processing has a lawful basis under CCPA.
What CCPA Actually Requires
The California Consumer Privacy Act (amended by CPRA in 2020) applies to for-profit businesses that meet any of these thresholds:
- Annual gross revenue exceeding $26,625,000 (the 2025-2026 inflation-adjusted figure)
- Processing personal information of 100,000 or more California residents or households annually
- Deriving 50% or more of annual revenue from selling or sharing personal information
Meeting any single threshold triggers the full set of CCPA obligations.
Core Consumer Rights
California residents have the right to:
Know: Consumers can request details about what personal information you collect, where it comes from, why you collect it, and who you share it with. If you've been sending customer data to ChatGPT for analysis, that's a category of processing you need to disclose.
Delete: Consumers can request deletion of their personal information, with some exceptions. If their data has been submitted to ChatGPT, you need to consider whether deletion is possible and what your obligations are.
Opt-Out: Consumers can opt out of the "sale" or "sharing" of their personal information. While OpenAI states they don't sell data, your organization's practices matter here. If you're using ChatGPT to process customer data and then using the outputs for marketing or customer profiling, you're potentially in "sharing" territory.
Correct: Consumers can request correction of inaccurate personal information.
Limit Sensitive Personal Information: Consumers can restrict how you use sensitive categories like Social Security numbers, financial account information, precise geolocation, health data, and more.
Non-Discrimination: You can't penalize consumers for exercising their privacy rights.
Penalties for Non-Compliance
As of January 1, 2025, CCPA fines stand at:
- $2,663 per negligent or unintentional violation
- $7,988 per intentional violation or violations involving minors
These amounts were inflation-adjusted in December 2024 and will be reviewed again in 2027. The per-violation structure means fines can compound quickly. If you've processed 10,000 California residents' data improperly, you're looking at $26.6 million to $79.8 million in potential exposure.
The 2026 AI Regulations: What's Changing
On September 23, 2025, the California Privacy Protection Agency finalized regulations that fundamentally change how CCPA applies to AI. These rules take effect January 1, 2026.
Automated Decision-Making Technology (ADMT)
The new regulations define ADMT as "any system, software or process, including one derived from machine-learning, statistics, or other data-processing or AI, that processes personal information and uses computation as whole or part of a system to make or execute a decision or facilitate human decision making."
ChatGPT clearly falls within this definition when you're using it to inform decisions about consumers.
What's Required
Pre-Use Notices: If you're using ADMT to make "significant decisions" about consumers, you must notify them before processing begins. Significant decisions include employment, housing, financial services, healthcare, and educational opportunities.
Opt-Out Rights: Consumers must be able to opt out of ADMT being used for significant decisions affecting them.
Right to Explanation: You must provide "meaningful information about the logic involved in such decision-making processes, as well as a description of the likely outcome of the process with respect to the consumer."
Try explaining how ChatGPT's neural network arrived at a specific recommendation about a job applicant. The explainability requirement alone makes using consumer-facing ChatGPT outputs for significant decisions extremely risky.
Risk Assessments
Before using ADMT for significant decisions, processing sensitive personal information, or training AI models on personal data, you must conduct a privacy risk assessment. These assessments must:
- Be completed before the processing begins
- Identify risks to consumers and potential benefits
- Document safeguards to mitigate risks
- Be reviewed and updated at least every three years
The first risk assessment submissions for 2026 and 2027 processing activities will be due by April 1, 2028.
Cybersecurity Audits
New cybersecurity audit requirements are phased by revenue:
- April 1, 2028: Companies with 2026 gross revenue over $100 million
- April 1, 2029: Companies with revenue between $50 million and $100 million
- April 1, 2030: Companies with revenue under $50 million
Where ChatGPT Falls Short
Let's be specific about the compliance gaps.
Training on data creates permanent exposure: When you use consumer-tier ChatGPT with training enabled (the default setting), that data may be incorporated into OpenAI's models. A California resident's deletion request doesn't "untrain" the model. You can't fully honor the deletion right for data that's been used for training.
No control over downstream processing: Once data goes to OpenAI, you don't control what happens to it. OpenAI's safety team reviews conversations. The data is retained for monitoring. If there's an internal incident at OpenAI, your customers' data is exposed and you may have notification obligations.
Explainability is impossible: The new ADMT regulations require you to explain AI decision-making logic. LLMs are not explainable systems. If you're using ChatGPT outputs to inform significant decisions, you cannot comply with the explanation requirement.
Opt-out mechanisms don't propagate: Even if you honor a consumer's opt-out request in your systems, that doesn't automatically prevent their data from being processed by ChatGPT if it's already embedded in a document you uploaded last month.
The Samsung problem: In 2023, Samsung employees uploaded source code and meeting notes to ChatGPT, leading to a company-wide ban. Any organization can make this mistake. The data goes to OpenAI before you realize it contained personal information.
The Workaround: Using ChatGPT While Maintaining Compliance
The solution is the same pattern that works for GDPR and every other privacy regulation: remove personal information before it reaches the AI.
Document with California residents' personal information
↓
Automated redaction (names, addresses, SSNs, financial accounts, etc.)
↓
Redacted content sent to ChatGPT
↓
AI processes only anonymized data
↓
Personal information never leaves your control
This approach means:
- No disclosure obligations for ChatGPT processing (there's no personal information being processed)
- No deletion requests to worry about (the AI never had the data)
- No ADMT transparency issues for significant decisions (the decision inputs don't include personal information)
- No training exposure (anonymized data can't identify anyone even if trained on)
Implementation Steps
Step 1: Map your data flows
Identify every place in your organization where personal information might touch ChatGPT:
- Customer service teams using ChatGPT for response drafting
- HR using it for resume screening or policy questions
- Finance using it for document analysis
- Legal using it for contract review
- Marketing using it for customer insights
Step 2: Classify by CCPA sensitivity
CCPA defines "sensitive personal information" as including:
- Social Security, driver's license, state ID, or passport numbers
- Account login credentials
- Financial account numbers with access codes
- Precise geolocation
- Racial or ethnic origin
- Religious beliefs
- Union membership
- Contents of mail, email, or text messages (where business is not the recipient)
- Genetic data
- Biometric information
- Health information
- Sex life or sexual orientation information
Any document containing these categories needs mandatory redaction before AI processing.
Step 3: Implement automated redaction
Manual review doesn't scale and misses things. You need automated detection and removal of:
- Names and identifiers
- Addresses and contact information
- Government-issued IDs
- Financial account numbers
- Health information
- Any other California-sensitive categories
Step 4: Establish clear policies
Document and enforce:
- Which ChatGPT tiers are approved for which use cases
- What types of data require redaction before AI processing
- Who can approve exceptions (if any)
- How to handle consumer rights requests related to AI processing
Step 5: Update privacy notices
Your California privacy notice needs to disclose if you're using AI to process personal information. Be specific about:
- Categories of personal information processed by AI
- Purposes for which AI is used
- Whether ADMT is involved in significant decisions
- How consumers can exercise their opt-out rights
Enterprise Alternatives
ChatGPT Enterprise offers stronger compliance positioning:
- Data is not used for training by default
- Data Processing Addendum available
- SOC 2 Type 2 audited security controls
- Admin controls for managing user access
- Custom retention policies
This doesn't eliminate the need for redaction when handling sensitive personal information, but it reduces the baseline risk. For organizations making significant investments in AI, the enterprise tier combined with proper data handling procedures provides the strongest compliance posture.
The Enforcement Trajectory
California's enforcement pattern is clear. In 2024, DoorDash paid $375,000 for participating in a marketing cooperative without proper consent. In 2025, Honda paid $632,500 for hindering opt-out rights. Healthline Media paid $1.55 million for unlawful data sharing. The amounts are increasing, and the scrutiny of AI practices is intensifying.
The new AI regulations signal where enforcement is heading. The Attorney General's office is already investigating employment services platforms for ADMT practices. Health and wellness apps faced a sweep in 2024. AI companies that process California residents' data are next.
The California Privacy Protection Agency has made clear that "any violation constitutes a CCPA violation." Using AI without proper safeguards isn't a gray area. It's exposure waiting to crystallize into an enforcement action.
Your Next Step
The gap between typical ChatGPT usage and CCPA compliance is significant, and it's getting wider as the 2026 AI regulations take effect. Closing that gap means implementing proper data handling before AI processing, not after.
If you're processing documents that contain California residents' personal information, automated redaction isn't a nice-to-have. It's the mechanism that makes AI usage defensible when the regulator comes calling.
PaperVeil lets you redact all your sensitive information from PDFs in a simple drag and drop flow. Detect and remove PII, match custom patterns, strip metadata, and generate audit trails. The redaction layer that makes AI document processing actually safe.