California ADMT Rules for Automated Decision-Making

The CCPA, as amended by the California Privacy Rights Act, directed the California Privacy Protection Agency (CPPA) to write rules on automated decisionmaking, risk assessments and cybersecurity audits. The CPPA board adopted the final package in July 2025; it was approved in September 2025 and took effect January 1, 2026, with later compliance dates for several duties. What counts as ADMT: technology that processes personal information and uses computation to replace, or substantially replace, human decision-making. "Substantially replace" means using the output to make a decision without meaningful human involvement. To count, a human reviewer must know how to interpret the output, actually review it alongside other relevant information, and have authority to change the decision. The final rules are narrower than earlier drafts, dropping behavioral advertising and some forms of extensive profiling from the ADMT obligations. Significant decisions: the ADMT duties apply to decisions that result in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or compensation, or healthcare services. Consumer rights: Before use, businesses must give a pre-use notice describing the purpose, the rights to opt out and to access information, and how the ADMT works. Consumers can opt out unless an exception applies. The main exception is offering an appeal to a qualified human reviewer; narrower ones cover certain admission, hiring and work-allocation uses where the tool works as intended and does not discriminate. Access requests entitle consumers to information about the logic and the output. Businesses using ADMT for significant decisions must comply by January 1, 2027. Risk assessments: these apply more broadly, for example to selling or sharing personal information and processing sensitive data. Existing processing must be assessed by the end of 2027, with summaries submitted to the CPPA starting in 2028. A common misconception is that any use of AI triggers these rules. What matters is whether the tool replaces human judgment in a significant decision.