California’s Automated Decision-Making Technology (ADMT) Regulations: Key Requirements and Timeline
The California Privacy Protection Agency (CPPA) has established a regulatory framework for Automated Decision-Making Technology (ADMT) under the California Consumer Privacy Act (CCPA), effective in stages beginning in 2026. These regulations apply to any business operating under the CCPA, including for-profit entities that collect or process personal data of California residents. The rules introduce mandatory pre-use notices, opt-out mechanisms, and access rights for consumers affected by significant automated decisions, alongside risk assessment obligations and cybersecurity audits.
The regulatory regime was formalized following the passage of Proposition 24 in November 2020, which amended the CCPA and created the CPPA to oversee its implementation. The ADMT regulations were adopted in September 2025, marking a structured approach to governing how businesses deploy automated systems that make decisions impacting consumers.
The CPPA’s authority to enforce these regulations stems from its mandate under the Administrative Procedures Act, allowing it to adopt and amend rules through a formal rulemaking process. While the ADMT regulations are now in effect, their application is phased, with distinct compliance deadlines for different requirements.
Mandatory Pre-Use Notices, Opt-Outs, and Access Rights (Effective January 1, 2027)
Beginning January 1, 2027, businesses subject to the CCPA must provide consumers with clear and conspicuous pre-use notices before deploying ADMT systems that produce significant decisions.
Consumers must also be granted the right to opt out of such automated decision-making processes where feasible. This requirement aligns with broader CCPA provisions on consumer rights and ensures transparency in how businesses use ADMT. Additionally, consumers will have the right to access the logic involved in automated decisions affecting them, though the CPPA acknowledges that full disclosure of proprietary algorithms may not always be practical.
Risk Assessments for Automated Decision-Making Systems (Effective January 1, 2026)
One of the earliest compliance obligations under the ADMT regulations is the requirement for businesses to conduct risk assessments for their automated decision-making systems. Effective January 1, 2026, businesses must evaluate the potential risks posed by ADMT, including biases, inaccuracies, and unfair outcomes that could disproportionately affect protected classes of individuals.
Phased Cybersecurity Audits for ADMT Systems
In addition to risk assessments, the CPPA has introduced a phased approach to cybersecurity audits for businesses using ADMT. While the exact timeline for these audits has not been fully detailed in public documents, the regulations imply that audits will be conducted periodically to ensure that ADMT systems are secure and resilient against cyber threats.
The CPPA’s phased approach suggests that smaller businesses may face less stringent audit requirements initially, with increased scrutiny applied over time.
Scope and Applicability of the Regulations
The ADMT regulations apply to all businesses covered under the CCPA, which includes for-profit entities that collect or process personal data of California residents.
This includes providing inadequate notices, failing to offer opt-out mechanisms, or neglecting to conduct required risk assessments.
Stakeholder Engagement and Future Rulemaking
Recent preliminary comment periods closed in 2026 on issues such as data broker audits, employee data protections, and reducing friction in exercising privacy rights.
The agency has also considered proposals for opt-out preference signals (OOPS), which aim to streamline consumer choices regarding data collection and processing. However, as of January 2026, no formal rulemaking packages have been proposed for these topics, indicating that the CPPA is still gathering input before finalizing any new regulations.
Businesses operating under the CCPA are advised to monitor the CPPA’s rulemaking activities closely, as additional requirements may be introduced in the coming years. Staying informed about these developments will be critical for maintaining compliance and avoiding potential enforcement actions. The CPPA’s website provides updates on rulemaking processes, including opportunities for public comment and stakeholder engagement.
Required actions
- Provide a pre-use notice before using ADMT for significant decisions (employment, housing, credit, education, healthcare) and honour opt-out and access rights - Conduct and retain risk assessments for processing that presents significant risk, including training ADMT, and submit attestations to the CPPA - Complete annual independent cybersecurity audits on a phased schedule by size