---
title: "Place marked facts under the section 1798.100 headings"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-an-ai-privacy-impact-assessment/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B6-5-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Place marked facts under the section 1798.100 headings

> Under headings for categories, purposes, sale or sharing, retention, necessity and proportion, and security, place only the facts the lawyer has already marked in the file. Write no conclusion and no score.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-an-ai-privacy-impact-assessment/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Under headings for categories, purposes, sale or sharing, retention, necessity and proportion, and security, place only the facts the lawyer has already marked in the file. Write no conclusion and no score. |
| What the lawyer must review | Section 1798.100(a), (c), and (e) are the opened California duties these headings follow. The page does not decide that collection is reasonably necessary and proportionate, or that security is reasonable. The California Privacy Protection Agency states that regulations adopted by its Board on 24 July 2025, approved by the Office of Administrative Law on 22 September 2025, and effective 1 January 2026, address risk assessments and automated decisionmaking technology. The approved regulation text was not opened, so this page does not describe what that assessment must contain. Opinion 512: a generated page is not the lawyer sign-off. |
| Written for | United States |
| Applies to | [Build an AI privacy impact assessment](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-an-ai-privacy-impact-assessment.md) |

## Checking plan

- What the AI does: Under headings for categories, purposes, sale or sharing, retention, necessity and proportion, and security, place only the facts the lawyer has already marked in the file. Write no conclusion and no score.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not describe the contents of the approved automated-decision regulations. That PDF was not opened.
- A federal-agency privacy impact assessment is a different document and is not built here.

## Sources

- [California Civil Code section 1798.100 (duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments and ADMT regulations](https://cppa.ca.gov/regulations/ccpa_updates.html) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*