New proposed CCPA regulations in California target automated decision-making technology

On July 24, 2025, the California Privacy Protection Agency finalized its proposed changes to regulations under the California Consumer Privacy Act (CCPA), which, when enacted, will create rules for businesses subject to the CCPA that use automated decision-making technology (ADMT). Because the term ADMT is so broadly defined, it may create new compliance obligations and risks for businesses subject to the CCPA that utilize artificial intelligence (AI).

In short, businesses that use ADMT to make decisions concerning consumers, conduct or use profiling, or use personal information to train the ADMT, will have to provide consumers with a pre-use notice and offer an opt-out option for the business’s use of ADMT. Consumers will also have the right to request information about how their information was used in conjunction with ADMT.

What is automated decision-making technology?

Under the proposed changes, ADMT is broadly defined as any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making, which likely includes most types of AI technology.

The definition of ADMT also includes, “profiling,” which is the automated processing and analyzing of personal information to evaluate certain personal aspects relating to a person and in particular to analyze or predict aspects concerning that person’s intelligence, ability, aptitude, performance at work, economic situation, health (including mental health), preferences, interests, reliability, predispositions, behavior, location, or movements.

What constitutes using ADMT under the proposed regulations?

The proposed regulations identify three uses of ADMR that trigger the new requirements:   

1. Use of ADMT to make “Significant Decisions” concerning a consumer. Significant decisions are those that have important consequences for consumers, such as decisions to provide or deny financial services, housing, insurance, educational or employment opportunities, healthcare services, or essential goods or services like groceries, medicine, or fuel.
2. Use of ADMT for “Extensive Profiling” of a consumer. Extensive profiling of a consumer is when a business analyzes a consumer’s personality, interests, behavior, or location in their workplace, at school, or in public places (e.g., using facial-recognition technology in a store to identify potential shoplifters), to target ads to them using data collection technology on websites.
3. Use of or intent to use personal information to train the ADMT in certain circumstances. A business that trains ADMT with personal information would be subject to the new regulations if it trains the ADMT (or intends to train it) to make significant decisions, identify people, or generate deepfakes.

What obligations would these proposed regulations create with respect to automated decision-making technology?

There are essentially three requirements that companies using ADMR will need to comply with pursuant to the proposed regulations:

1. Prepare a pre-use notice about the business’s use of ADMT. This notice will need to include details about the business’s use of ADMT, such as why the business wants to use ADMT, how ADMT would work, and what the consumer’s rights under the CCPA consist of with respect to ADMT. Of importance, the notice must be provided prior to any use of ADMT associated with the consumer’s information.
2. Provide an opt-out option. Unless an exception applies, the business will have to provide the consumer with an easy way to opt out of the business’s use of ADMT.
3. Provide access to ADMT information. If a consumer does not opt out, the business must provide the consumer with an easy way to access information about how the business used ADMT with respect to them.

The practical takeaway

While the regulation, if enacted, won’t come into effect until January 1, 2027, businesses subject to the CCPA should assess their business practices to determine whether their use of technology, including AI , meets the definition of ADMR and whether their uses fall into one of the three categories.