UPDATE – JANUARY 2026:
California’s Automated Decision-Making Technology (ADMT) regulations have completed rulemaking and taken effect. The CPPA Board adopted the final package on July 24, 2025, and the Office of Administrative Law approved and filed the rules by September 23, 2025. The ADMT, cybersecurity audit, and risk assessment regulations officially became operative on January 1, 2026, with full ADMT compliance for existing systems required by January 1, 2027.
The final regulations establish opt-out and access rights for ADMT used in “significant decisions,” including employment, lending, housing, education, and healthcare, and require pre-use notices disclosing purpose, logic, and impacts. High-risk processing triggers mandatory risk assessments, with CPPA and Attorney General enforcement and civil penalties for non-compliance. While no private right of action exists, documentation obligations and independent audit requirements increase transparency and oversight.
The rules align with California’s broader tightening of AI, privacy, and profiling standards under the CCPA/CPRA and operate alongside new cybersecurity audit duties and risk assessment submissions. Staggered deadlines and sector-specific obligations reflect an enforcement posture focused on operational compliance rather than voluntary adoption.
ORIGINAL NEWS STORY:
CA Privacy Agency Proposes Draft Regulations on ADMT
As the United States grapples with AI considerations at the federal level, California is taking proactive steps through the California Privacy Protection Agency (CPPA). The CPPA has released a set of draft regulations designed to spark discussion and gather public input on proposed rules governing businesses’ utilization of Automated Decision-Making Technology (ADMT) and related consumer rights. The primary objective of these regulations is to enhance transparency and afford consumers greater control over automated systems that influence them.
Overview of California’s ADMT Draft Rules
The draft regulations broadly define “automated decision-making technology,” encompassing any software or process that employs personal data to make or facilitate decisions, including profiling. Key consumer rights stipulated in the proposed rules include:
1. Right to Opt-Out:
Businesses must provide consumers with a means to opt out of specific uses of ADMT, especially those carrying legal or similarly significant consequences. This includes decisions related to financial services, employment, healthcare, and housing. Opt-out rights extend to automated profiling in contexts such as the workplace or public spaces.
2. Right to Access Information:
Consumers possess the right to access meaningful information from businesses regarding the logic, purpose, and impact of ADMT used in determinations about them. Businesses are obligated to elucidate the factors and logic applied by these systems, including the role of human review.
3. Enhanced Transparency:
Businesses are required to furnish advance notice elucidating their intended purpose and use of automated decision-making technologies before processing consumer data. This preemptive disclosure empowers consumers to decide whether to opt out of the ADMT.
4. Special Provisions for Minors:
Behavioral advertising targeted at minors under the age of 16 is subject to additional safeguards and parental consent requirements.
The draft regulations aim to balance consumer empowerment through transparency with businesses’ ability to leverage ADMT for beneficial purposes. As the inaugural state privacy agency in the U.S., the CPPA seeks broad public input on these intricate issues at the crossroads of technology, business, and consumer rights. It’s important to note that these draft regulations may undergo substantial changes before finalization. Concurrently, the CPPA will consider risk assessment requirements during its board meeting on December 8. The CPPA has had a busy year discussing AI-related topics, including cybersecurity audits.
Need Help?
You might be navigating the potential impact of this regulation and others globally. Hence, BABL AI’s team of audit experts is ready to provide valuable insights and assistance.
