---
title: "Assess risky processing for US laws too · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments
updated: 2026-10-20
licence: "All rights reserved"
---

# Assess risky processing for US laws too

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- Rule: Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
- How: Most state laws require these assessments and let the attorney general ask for them. California's regulations, in force since 1 January 2026, add more. Risk assessments start in 2026, with a summary due to the state's privacy agency by 1 April 2028. Rules on automated decisions apply from 1 January 2027. Cybersecurity audits are phased in from 2028 to 2030 by revenue. Add the US triggers to the [DPIA screening](https://agentwranglers.se/playbook/compliance/records-and-data-map/dpia-screening), so one screening covers both.
- Check: The screening file has fields for targeted ads, sale, profiling and sensitive data. The build fails when any is true and no assessment link is filled in.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments`.

- Previous: [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law)
- Next: [Keep the US breach notice laws as data](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-breach-notice-laws)
- [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)