Publications + Presentations

Publications + Presentations

Back to Publications + Presentations
Article

Clarifying CCPA Requirements for the Use of Automated Decisionmaking Technology

February 3, 2025
by David M. Wilson
High tech looking image of 0's and 1's resembling a face

Update:

On July 24, 2025, the CPPA Board voted to approve revised regulations.

For further clarification on how these regulations impact your business or to discuss how to operationalize potential requirements, contact David Wilson at dwilson@keglerbrown.com.

Summary

  • The CPPA Board adopted new regulations on November 8th (subject to additional rulemaking), addressing the use of Automated Decisionmaking Technology (ADMT) in various sectors including lending, insurance, education, HR, and behavioral advertising.
  • ADMT includes technology that executes decisions, replaces human decision-making, or substantially facilitates it. The regulations clarify that technologies like spreadsheets could be considered ADMT.
  • The regulations apply if ADMT is used for significant decisions, extensive profiling, or training purposes. Significant decisions include those affecting access to financial services, housing, employment, and more.
  • Businesses must provide pre-use notices, opt-out rights, access rights, and conduct risk assessments when using ADMT for significant decisions, extensive profiling, or training.

On November 8th, the CPPA Board voted to adopt new regulations related to Automated Decisionmaking Technology (ADMT). Among other topics, these regulations, subject to additional rulemaking, address requirements with respect to the use of ADMT in lending, insurance, education opportunities, HR/labor, and profiling for behavioral advertising.

What is Automated Decisionmaking Technology?

ADMT is technology that processes personal information and uses computation to: 

  • Execute a decision, 
  • Replace human decision making, or 
  • Substantially facilitate human decisionmaking (let’s talk about what this means).

Could A Spreadsheet Be ADMT?

The regulations define the concept of substantially facilitating human decisionmaking and clarify that certain technologies (such as a spreadsheet) are not necessarily ADMT, but could be. Similarly, artificial intelligence can be ADMT, but not all ADMT is AI.

So, When Do ADMT Regulations Apply?

In general, these regulations will apply if there is ADMT and at least one of the following three activities:

1. A significant decision concerning a consumer, or
Among others, “significant decisions” include decisions using non-exempt information that result in access to, or the provision or denial of, financial or lending services, housing, insurance, education enrollment or opportunity, employment, or independent contracting opportunities or compensation, healthcare services, or essential goods or services.

2. Extensive profiling, or
“Extensive profiling” includes work or educational profiling, public profiling, or profiling for behavioral advertising.

3. Training uses 
Processing personal information to train ADMT that is capable of being used:

  • For a significant decision,
  • To establish individual identity,
  • For physical or biological identification or profiling, or
  • For the generation of a deepfake.

In other words, the requirements are applicable to a business that is subject to the CCPA and does any of the following:

  1. Uses ADMT to make a significant decision, 
  2. Uses ADMT for extensive profiling, or
  3. Uses personal information to train ADMT that could be used in any of the following ways:

a.    To identify people, 
b.    For physical biological identification or profiling, 
c.    To make significant decisions, or 
d.    To generate deep fakes. 

What Do the ADMT Regulations Require?

The regulations include additional requirements, but in general a business that uses ADMT must provide consumers with:

Pre-Use Notice

Provide the consumer with a Pre-use Notice informing the consumer about the businesses’ use of ADMT and the consumer’s right to: (i) opt-out of ADMT and (ii) access ADMT. The regulations include detailed requirements for the content and form of the pre-use notice.

Opt-out Right

  • Consumers have a right to opt-out of uses of ADMT for significant decisions, extensive profiling, and training uses unless an exception applies. In other words, as drafted, a business must provide consumers the ability to opt-out of these uses of ADMT, except as set forth in the narrow exceptions.
  • The regulations list several narrow exceptions. By way of example, provided the use of ADMT is necessary to achieve, and is used solely for, the security, fraud prevention, or certain listed safety purposes, the business is not required to provide a consumer with the ability to opt-out of such use of ADMT for a significant decision.

Access Right

Consumers have a right to access ADMT when a business uses ADMT for a significant decision or extensive profiling. The regulations include detailed requirements related to what information a business must provide and how the business must make the right available and respond to consumers.

Risk Assessment

  • Prior to using ADMT for a significant decision, extensive profiling, or training uses, a business must conduct a written risk assessment. The regulations include detailed requirements for the form and content of the risk assessment, including a list of operational elements that must be identified.
  • Regulations also require the business to designate an executive and submit a written certification that the business conducted the risk assessment as set forth in the regulations, with an attestation from the designated executive that they have reviewed, understood, and approved the business’s risk assessments that were conducted and documented as set forth in the regulations, and that the processing occurred only after the conducting and documenting the required risk assessment.
    • The designated executive’s name, title, signature, and the date of certification must be included in the written certification.  

For further clarification on how these regulations impact your business, contact David Wilson at dwilson@keglerbrown.com.