Internet Lawyer Blog
California businesses using Automated Decision-Making Technology (“ADMT”) should prepare for a significant privacy compliance deadline on January 1, 2027. The California Privacy Protection Agency’s regulations require covered businesses to provide notices and consumer rights when qualifying technology makes specified significant decisions. Updating a privacy policy alone will not establish a working process for handling those decisions.
California ADMT compliance begins with understanding how software actually influences outcomes. A product may be marketed as an assistant while effectively determining who receives a job offer or access to housing. Conversely, a business may use sophisticated software without triggering these particular rules. The applicable definitions and the actual decision process must guide the assessment.
Confirm CCPA Coverage and Applicable Exemptions
The ADMT requirements operate within the California Consumer Privacy Act, or CCPA. Start by determining whether the organization meets the statutory definition of a business under Civil Code section 1798.140. Review applicable thresholds, relevant relationships with other entities, and exemptions. A small organization should not assume that purchasing an enterprise software subscription makes it a covered business.
The analysis also concerns the information being processed. Certain exemptions are tied to particular data or activities rather than an entire industry. An employer should consider information about California employees and applicants in its assessment. Record the basis for each coverage determination so that a later acquisition, revenue change, or new use of personal information prompts another review.
Identify Technology That Makes Significant Decisions
Under title 11 of the California Code of Regulations, section 7001, ADMT processes personal information and replaces or substantially replaces human decisionmaking. The regulations describe meaningful human involvement in terms of a reviewer’s ability to interpret the output, analyze relevant information, and make or change the decision. A routine approval click does not necessarily establish that involvement.
Significant decisions include specified decisions concerning financial services, housing, educational opportunities, employment or independent contracting opportunities or compensation, and healthcare services. Advertising to a consumer is excluded from this definition. Businesses should apply the detailed regulatory definitions instead of assuming that every algorithm, profiling activity, or use of artificial intelligence falls within Article 11.
Build an Inventory Around Business Decisions
For each potentially covered use, identify the decision, the affected individuals, the information supplied to the system, and the output received. Then interview the person who handles that output. Ask what happens when the software recommends rejection, whether anyone examines contrary evidence, and who has authority to approve an exception. Written procedures should match actual practice.
For example, a hypothetical employer may describe a screening score as advisory, yet automatically remove every applicant below a threshold before a recruiter opens the application. That operation requires closer examination than the vendor’s advisory label suggests. Mapping the sequence can reveal that the decisive step occurs earlier than management expected, including inside an outsourced service.
Provide a Specific Preuse Notice
Section 7220 requires a prominent pre-use notice explaining the particular purpose of covered ADMT and the applicable consumer rights. The notice generally belongs at or before collection of the information intended for that processing. If previously collected information will be used for a different, covered ADMT purpose, the notice must precede that processing. It may be incorporated into a compliant notice at collection.
Describe the decision in terms a person can recognize. Explain the relevant information and output, how the output affects the decision, and the alternative process where an opt-out is available. Identify any applicable exception as required. Product and legal teams should review the same final language so the notice does not promise a manual process that operations cannot deliver.
Create an Opt Out Process That Changes Processing
Section 7221 generally requires an opportunity to opt out, subject to specified exceptions. Where required, businesses must provide at least two designated request methods. Online interactions require an appropriate interactive form accessible through the pre-use notice. A general cookie banner alone does not satisfy the ADMT opt-out requirement. The process must be easy to use and avoid unnecessary account or information demands.
If a person opts out before the covered processing begins, the business must not start that processing. For an opt-out received after processing starts, the regulation requires cessation as soon as feasible and no later than 15 business days, with instructions to relevant recipients to comply within the same period. Build a reliable connection between the request system and the operational software.
Evaluate Exceptions and Human Appeals Carefully
The regulations permit specified exceptions to providing an opt-out, including a qualifying human appeal process. Other exceptions concern limited admission, hiring, work allocation, and compensation uses that meet stated conditions. An exception to the opt-out requirement does not eliminate every notice, access, or other applicable obligation. Counsel should document which exception is being used and why its conditions are satisfied.
For a human appeal, choose a reviewer who understands the output and has genuine authority to change the decision. Provide a way for the individual to submit relevant information. Test whether the reviewer can access that information and record the result. A help desk that merely repeats the automated outcome is unlikely to perform the function the business has promised.
Prepare Meaningful Responses to Access Requests
Section 7222 addresses requests for information about covered ADMT use. A response must explain the particular purpose, relevant logic, and outcome for the requesting consumer, including how the output influenced the decision. These requests involve identity verification, while opt-out requests follow different verification rules. Applicable protections for trade secrets and security information require a specific assessment.
Prepare an example response using a fictional record. Ask whether a reader could understand what happened without access to the vendor’s technical manual. Determine which records the business must retrieve to produce that explanation and how quickly the vendor can supply them. A generic description of machine learning will not necessarily explain an individual decision.
Coordinate Vendors and Related Privacy Requirements
Review agreements for assistance with consumer requests, explanations, changes to processing, and access to necessary records. Assign responsibility for communicating opt-outs to each affected provider. If a vendor changes the model, inputs, or explanation tools, determine whether notices and response procedures need revision. Preserve enough version information to explain a decision made before an update.
Keep the ADMT deadline separate from related requirements. The CPPA regulations became effective on January 1, 2026, but section 7200 sets January 1, 2027, for ADMT compliance. Risk assessment duties began on a different schedule, with transitional treatment for existing processing. Cybersecurity audit certification deadlines are phased. A later reporting deadline does not postpone an earlier operational obligation.
Test the Complete Process Before the Deadline
Run a practice exercise from notice delivery through an opt-out, an access request, and any promised appeal. Include the personnel who would handle an actual request. Check that the decision process changes when it should and that the response corresponds to the correct person and system version. Record unresolved problems and assign completion dates before January 1, 2027.
Our law firm helps businesses evaluate automated decisionmaking, privacy compliance, and technology agreements. We can review coverage, proposed notices, vendor responsibilities, and procedures for responding to consumer requests. Contact our law firm for a free initial consultation about preparing your operations for California’s ADMT requirements.