California Automated Decision-Making (ADMT) Rules Under the CCPA: A Business Guide

In effect Primary law: CA CPPA ADMT Regs · 11 Cal. Code Regs. §§ 7200-7232

California's privacy regulator, the California Privacy Protection Agency (CPPA), finalized binding rules in late 2025 governing automated decision-making technology (ADMT) — the AI and algorithms businesses use to make significant decisions about Californians. The ADMT regulations took effect April 1, 2026, with phased compliance running into 2027. If you use AI to make or substantially inform decisions about hiring, housing, credit, healthcare, education, or essential services for California residents, these rules give those residents pre-use notice, opt-out, and access rights — and they apply to employees and applicants, not just consumers.

What the law requires

Give pre-use notice. Before using ADMT for a significant decision, businesses must provide a pre-use notice explaining the technology, its purpose, and how the consumer can exercise their rights.
Offer an opt-out. Consumers can opt out of ADMT used for significant decisions (with limited exceptions), and businesses must honor it.
Provide access / explanation. Consumers can request access to information about how ADMT made a decision about them.
Do risk assessments and audits. The broader CCPA/CPRA framework requires risk assessments for high-risk processing and cybersecurity audits, with documentation deadlines into 2027.

Who must comply

For-profit businesses subject to the CCPA/CPRA (broadly, $25M+ annual revenue, personal data on 100,000+ consumers/households, or 50%+ revenue from selling/sharing personal data) that use ADMT for 'significant decisions' (employment, housing, education, healthcare, financial/lending services, or essential goods/services), for extensive profiling, or for training certain models. Because California treats employees and applicants as consumers for these purposes, HR uses of AI are squarely in scope.

Penalties & enforcement

Administrative fines under Cal. Civ. Code § 1798.155 are up to $2,500 per violation, rising to $7,500 per intentional violation or any violation involving consumers under 16. The CPPA and the California Attorney General both enforce. Separately, California's Civil Rights Council automated-decision-system regulations apply FEHA anti-bias duties to AI hiring/employment tools, adding discrimination exposure.

How to comply: a practical checklist

Inventory every AI/algorithmic system that makes or materially influences significant decisions about Californians — including HR and lending uses.
Draft and deploy pre-use ADMT notices before the relevant compliance dates.
Build an opt-out mechanism for ADMT significant decisions and a process to honor access/explanation requests.
Complete and document risk assessments for high-risk processing and the required cybersecurity audits on the CPPA's phased timeline.
Map HR/recruiting AI to both the CPPA ADMT rules and the Civil Rights Council FEHA automated-decision-system regulations.
Track the phased deadlines: the regulations are effective April 1, 2026 with ADMT significant-decision and risk-assessment obligations phasing in through 2027.

Get an alert the moment this changes

AI law moves fast — effective dates shift, rules get repealed and replaced, new bills pass. Create a free AI Laws USA account, watch the laws on this page, and get an email the moment one of them moves, takes effect, or is challenged. Free for the public, journalists, and students.

Create a free account & set alerts → See team plans

The laws this guide is built on

Every claim above traces to one of these verified entries in our index. Each links to its full record and its official source. Status labels reflect the live dataset as of 2026-06-17.

In effect Stronger protection

CCPA/CPRA + ADMT Regulations

California · Effective 2026-01-01 · Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6

California's main privacy law gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their personal information. New regulations finalized in 2025 add rights around automated decision-making technology (ADMT): businesses using ADMT for significant decisions (jobs, housing, credit, healthcare) must give pre-use notice, let people opt out, and provide access to how decisions were made.

View full entry → · Official source ↗
In effect Stronger protection

CA CPPA ADMT Regs

CA · Effective 2026-04-01 · 11 Cal. Code Regs. §§ 7200-7232

California's privacy agency finalized binding regulations governing automated decision-making and AI used to make significant decisions about Californians — including hiring, housing, education, healthcare, financial services, and ads to minors. Consumers gain rights to pre-use notice, opt-out, and access to information about how AI made the decision.

View full entry → · Official source ↗
In effect Stronger protection

California CRC rules (FEHA anti-bias law applied to AI hiring/employment tools)

California · Effective 2025-10-01 · Cal. Code Regs. tit. 2 (Civil Rights Council ADS regulations); Cal. Gov. Code 12940 et seq. (FEHA)

These regulations make clear that California's existing anti-discrimination employment law applies to automated-decision systems, including AI tools used in hiring, promotion, and other job decisions. Employers cannot use AI or algorithmic tools that discriminate against people based on protected characteristics such as race, sex, age, or disability, and must keep records related to these systems for at least four years.

View full entry → · Official source ↗

Browse all California AI laws in the directory → · See the automated decisions topic → · California jurisdiction overview →

Frequently asked questions

What is ADMT under California law?

Automated decision-making technology — AI or algorithmic systems that make, or substantially replace human judgment in, significant decisions about people. See the CPPA ADMT regulations entry and the final regulation text.

When do the California ADMT rules take effect?

The CPPA's ADMT regulations took effect April 1, 2026, with phased compliance for ADMT significant-decision and risk-assessment obligations running through 2027.

Do the ADMT rules cover employees and job applicants?

Yes. California treats employees and applicants as consumers for CCPA/CPRA purposes, so AI used for hiring and employment decisions is in scope — and the Civil Rights Council ADS regulations add FEHA anti-bias duties.

Who has to comply?

For-profit businesses meeting CCPA thresholds (≈$25M revenue, 100k+ consumers, or 50%+ revenue from selling/sharing data) that use ADMT for significant decisions, extensive profiling, or certain model training. See the CCPA/CPRA + ADMT entry.

What are the penalties?

Up to $2,500 per violation and $7,500 per intentional violation or violation involving a consumer under 16, enforced by the CPPA and the California Attorney General.