Agent WranglersCMP-60Recommended US law
Assess risky processing for US laws too
Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
Region
United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
How to do it
Most state laws require these assessments and let the attorney general ask for them. California's regulations, in force since 1 January 2026, add more. Risk assessments start in 2026, with a summary due to the state's privacy agency by 1 April 2028. Rules on automated decisions apply from 1 January 2027. Cybersecurity audits are phased in from 2028 to 2030 by revenue. Add the US triggers to the DPIA screening, so one screening covers both.
How to check
The screening file has fields for targeted ads, sale, profiling and sensitive data. The build fails when any is true and no assessment link is filled in.
Sources
Related rules
- CMP-10 Screen every new feature for a DPIA in Compliance and governance
- CMP-67 Give notice and an appeal before automated decisions in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.