California CCPA Regulations on Automated Decision-making Technology
Gives California consumers pre-use notice, opt-out and access rights over automated decision-making used for significant decisions, and requires risk assessments plus cybersecurity audits.
Key dates
- Jul 24, 2025Regulations approved by the Office of Administrative Law
- Jan 1, 2026Regulations take effect
- Jan 1, 2027ADMT compliance deadline for covered businesses
Risk areas addressed
Who it applies to
Businesses subject to the CCPA that use automated decision-making technology for significant decisions about California consumers.
Penalties & enforcement
CCPA administrative fines per violation, higher for violations involving minors.
Enforced by: California Privacy Protection Agency
California ADMT Regulations is enforced by California Privacy Protection Agency. The next dated milestone falls on Jan 1, 2027, 151 days away: ADMT compliance deadline for covered businesses. In practice that means knowing which of your AI systems fall in scope across every sector you operate in, holding assessments that speak to privacy, transparency and human oversight, and being able to produce that evidence on request, including for systems built outside the jurisdiction.