CCPA regulations on automated decisionmaking technology (Cal. Code Regs., tit. 11, § 7001 et seq.; Article 11)

Summary

The California Privacy Protection Agency's regulations, approved by the Office of Administrative Law on September 22, 2025, add rules on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits to the CCPA regulations. A business that uses ADMT to make a significant decision about a consumer (one that results in the provision or denial of financial or lending services, housing, education, employment or compensation, or healthcare services) must give a pre-use notice and honor consumers' rights to opt out of and access information about the ADMT, subject to stated exceptions. The regulations took effect on January 1, 2026; businesses using ADMT for significant decisions must comply by January 1, 2027. Risk-assessment attestations and cybersecurity-audit certifications are phased in from April 2028.

Key dates

1. January 1, 2026Takes effect
2. October 16, 2026Checked against sources
3. October 18, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. The regulations go into effect January 1, 2026.

   Supports: Effective date

   Businesses that use ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027.

   Supports: ADMT compliance date

   California Finalizes Regulations to Strengthen Consumers' Privacy California Privacy Protection Agency Primary source

2. On September 22, 2025, the regulations were approved by the Office of Administrative Law and filed with the Secretary of State.

   Supports: OAL approval date

   CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT, and Insurance Regulations (rulemaking page) California Privacy Protection Agency Primary source

3. "Significant decision" means a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.

   Supports: Definition of significant decision

   (a) A business that uses ADMT to make a significant decision concerning a consumer must comply with the requirements of this Article.

   Supports: Who the ADMT article applies to

   Text of Regulations (approved) California Privacy Protection Agency Primary source