---
title: "Assess risky processing for US laws too · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments
id: CMP-60
level: Recommended
region: US
updated: 2026-10-27
build: a2a6bdfed830
tokens: 702
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Assess risky processing for US laws too

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-60
- Level: Recommended
- Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)
- Rule: Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
- Check: The screening file has fields for targeted ads, sale, profiling and sensitive data. The build fails when any is true and no assessment link is filled in.
- Region: United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Most state laws require these assessments and let the attorney general ask for them. California's regulations, in force since 1 January 2026, add more. Risk assessments start in 2026, with a summary due to the state's privacy agency by 1 April 2028. Rules on automated decisions apply from 1 January 2027. Cybersecurity audits are phased in from 2028 to 2030 by revenue. Add the US triggers to the [DPIA screening](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening.md), so one screening covers both.

## Sources

- [California Privacy Protection Agency regulations](https://cppa.ca.gov/regulations/)

## Related rules

- CMP-10 [Screen every new feature for a DPIA](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening.md) in Compliance and governance
- CMP-67 [Give notice and an appeal before automated decisions](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/automated-decision-rights.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law.md)
- Next: [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-breach-notice-laws.md)
- [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)