Internet Lawyer Blog

The timeline for corporate cybersecurity compliance is contracting. For years, corporate boards, general counsel, and compliance officers treated quantum computing as a distant technical problem. That approach is becoming increasingly difficult to defend as federal agencies, standards bodies, and major infrastructure providers accelerate their post-quantum cryptography roadmaps.

In 2024, the National Institute of Standards and Technology (NIST) finalized its first three post-quantum cryptography standards: FIPS 203 / ML-KEM for key establishment, FIPS 204 / ML-DSA for digital signatures, and FIPS 205 / SLH-DSA as an additional stateless hash-based digital signature standard. NIST has advised organizations to begin migrating systems to quantum-resistant cryptography and has identified a transition pathway that will deprecate and ultimately remove quantum-vulnerable algorithms from its standards by 2035, with high-risk systems moving earlier.

Industry leaders are also accelerating their own schedules. For example, Cloudflare announced a 2029 target for full post-quantum security across its product suite, including authentication, and has separately tied the urgency to recent research developments and federal transition deadlines. The practical message for enterprise leaders is straightforward: post-quantum migration is no longer merely an IT modernization project. It is a legal, contractual, regulatory, and governance issue.

Quantum computing is becoming a serious legal, cybersecurity, and business risk-management issue. Although practical quantum computers capable of defeating widely used cryptographic systems are not known to exist today, businesses should not wait until the risk becomes immediate before planning for it. The migration from existing cryptographic systems to quantum-resistant systems may take years, and in some cases the risk already exists because sensitive encrypted data can be collected now and decrypted later when stronger quantum capabilities become available.

For companies that store confidential information, process personal information, use cloud services, rely on digital signatures, operate e-commerce platforms, manage intellectual property, or maintain regulated data, quantum computing should be part of the cybersecurity and legal compliance conversation. This includes businesses subject to privacy laws, cybersecurity requirements, vendor-management obligations, data retention duties, contractual security commitments, and regulatory oversight.

What Is Quantum Computing?

California businesses that use artificial intelligence, automated scoring, profiling tools, or large-scale consumer data practices cannot afford to treat the California Privacy Protection Agency’s 2026 regulations as a future problem. The rules governing Automated Decision-Making Technology (ADMT), privacy risk assessments, and cybersecurity audits are already reshaping compliance expectations. Businesses that wait until regulators come knocking may discover that they are missing the documentation, internal controls, and governance structure needed to defend their data practices.

This article was drafted to serve as practical guidance for businesses, executives, compliance teams, privacy professionals, and technology counsel trying to understand what California’s 2026 privacy regulations require. While many organizations focus on consumer-facing privacy notices, the more consequential issue in 2026 is operational readiness. Companies need to know when a risk assessment is required, when an automated decisionmaking workflow may trigger opt-out or access obligations, and when an annual cybersecurity audit becomes mandatory.

The reality is that many businesses already use tools that can fall within California’s automated decisionmaking framework. Hiring software, lead-scoring systems, fraud tools, underwriting models, identity verification services, recommendation engines, and internal profiling tools may all create compliance exposure depending on how they are used. In other words, a company does not need to market itself as an “AI business” to face AI-related privacy obligations.

Cryptocurrency fraud has become one of the fastest-growing forms of consumer financial crime. As digital assets gain mainstream adoption, criminals increasingly exploit confusion around blockchain technology, online anonymity, and cross-border transactions. Many consumers assume that once cryptocurrency is stolen, the perpetrators are impossible to identify or pursue. That assumption is often incorrect.

In reality, there are legal, forensic, and investigative methods available to track down cryptocurrency criminals, including those who target consumers in California and throughout the United States. While not every case results in full recovery, modern blockchain transparency and legal tools make crypto fraud far more traceable than many victims realize.

Understanding the Myth of Cryptocurrency Anonymity