California CCPA Automated Decision-Making Technology Regulations (CPPA ADMT Rules)

Properties

jurisdiction: US, California
level: state
domain: automated-decision
status: in-effect
scope: Regulations under the California Consumer Privacy Act governing businesses' use of automated decision-making technology to process consumers' personal information for significant decisions affecting finances, housing, education, employment, or health care.
obligations: Businesses using ADMT for significant decisions must: provide a Pre-use Notice disclosing the specific purpose for using ADMT and consumers' rights; honor consumer opt-out rights; honor consumer requests to access information about ADMT use. Risk assessment and cybersecurity audit requirements effective January 1, 2026. ADMT-specific compliance with opt-out and access rights required by January 1, 2027.
effectiveDate: 2026-01-01
enactedDate: 2025-09-22
appliesTo: businesses subject to the CCPA that use ADMT to make or substantially make significant decisions affecting California consumers
officialUrl: https://cppa.ca.gov/regulations/ccpa_updates.html
notes: CPPA Board adopted July 24, 2025; approved by Office of Administrative Law and filed with Secretary of State September 22, 2025. Risk assessment provisions effective January 1, 2026. ADMT opt-out and access rights compliance required January 1, 2027. Attestations to CPPA due April 1, 2028.

jurisdiction: US, California
level: state
domain: automated-decision
status: in-effect
scope: Regulations under the California Consumer Privacy Act governing businesses' use of automated decision-making technology to process consumers' personal information for significant decisions affecting finances, housing, education, employment, or health care.
obligations: Businesses using ADMT for significant decisions must: provide a Pre-use Notice disclosing the specific purpose for using ADMT and consumers' rights; honor consumer opt-out rights; honor consumer requests to access information about ADMT use. Risk assessment and cybersecurity audit requirements effective January 1, 2026. ADMT-specific compliance with opt-out and access rights required by January 1, 2027.
effectiveDate: 2026-01-01
enactedDate: 2025-09-22
appliesTo: businesses subject to the CCPA that use ADMT to make or substantially make significant decisions affecting California consumers
officialUrl: https://cppa.ca.gov/regulations/ccpa_updates.html
notes: CPPA Board adopted July 24, 2025; approved by Office of Administrative Law and filed with Secretary of State September 22, 2025. Risk assessment provisions effective January 1, 2026. ADMT opt-out and access rights compliance required January 1, 2027. Attestations to CPPA due April 1, 2028.