Are all boutique hotels subject to California’s new privacy audits?
No. First establish whether the business is covered; then assess each additional obligation. CPPA’s published coverage criteria include the applicable $26.625 million annual-revenue threshold, buying/selling/sharing information of 100,000 or more California residents or households, or deriving at least half of annual revenue from selling or sharing such information. Certain controlled entities and arrangements can also be covered. CPPA business-scope FAQ.
Do not test only the revenue of one property while ignoring the relevant entity structure and data practices.
The regulations effective January 1, 2026 introduce activity-specific risk assessments, cybersecurity audits and automated-decisionmaking requirements. Covered significant-decision ADMT use must comply from January 1, 2027. Audit-certification deadlines are phased across April 1, 2028, 2029 and 2030 for businesses actually subject to the audit rules. CPPA implementation announcement. (cppa.ca.gov)
For qualifying processing begun before January 1, 2026 and continuing afterward, the regulations provide a December 31, 2027 risk-assessment deadline. Significant decisions include defined employment decisions, such as hiring and allocation of work. Regulations, §§7001, 7155 and 7200.
Owner-side technology diligence:
- Obtain a scoped applicability memorandum, not a generic “CCPA compliant” badge.
- Inventory booking, guest-marketing, payment and workforce tools.
- Identify the purpose and actual decision-making role of each AI feature.
- Ask who handles requests, risk assessments and vendor evidence after an operator change.
- Price the work required at the relevant entity or portfolio level; avoid charging each property for the same centralized task.
Does outsourcing payments eliminate PCI work?
Do not accept that conclusion without checking the payment architecture. PCI DSS v4.0.1 did not move the March 31, 2025 effective date for the previously future-dated requirements. This is an industry payment-security standard, rather than a new hotel-specific federal regulation. PCI SSC version guidance.
For the revised SAQ A eligibility criterion concerning script attacks, PCI SSC distinguishes embedded payment forms from redirects and fully outsourced payment flows. It also directs merchants to their compliance-accepting entity to determine the appropriate questionnaire. PCI SSC FAQ 1588.
Recommended purchase and operator-transition evidence: Current validation documents, merchant-account responsibilities, payment-flow diagrams, vendor confirmations, incident history and a named owner of website scripts. An operator’s corporate certificate should not substitute for evidence covering the acquired hotel’s actual environment.