Appearance
CCPA ADMT Regulations
The CCPA ADMT Regulations are the regulations of the California Privacy Protection Agency (CalPrivacy, the Agency) on automated decisionmaking technology (ADMT). They are part of the implementing regulations of the California Consumer Privacy Act (CCPA). The CCPA is in Civil Code § 1798.100 et seq.
The CCPA regulations are in California Code of Regulations, Title 11, Division 6, Chapter 1 (§§ 7000 et seq.).
The regulations that apply from January 1, 2026 include the amendments that the Agency Board adopted on July 24, 2025. The Office of Administrative Law approved these amendments on September 22, 2025.
Article 11 applies to a business that "uses ADMT to make a significant decision concerning a consumer" (§ 7200(a)). See Dates for the Article 11 compliance dates and the Article 10 risk-assessment time limits.
Modulos gives the regulations as two Frameworks: MFF-29 for the AI System of one ADMT, and OFF-29 for the Organization. The section Operationalizing the CCPA ADMT Regulations in Modulos gives the Requirements and the steps that Modulos recommends.
Use the CCPA tests
Colorado SB 26-189, the GDPR, the EU AI Act, NYC Local Law 144, and California SB 947 have different tests. In the CCPA regulations, ADMT has a three-part test for human involvement (§ 7001(e)(1)). Only the five types of decision in § 7001(ddd) are significant decisions.
Primary sources
- CCPA regulations, California Code of Regulations, Title 11, §§ 7000 et seq.: California Privacy Protection Agency, Law and Regulations.
- The California Consumer Privacy Act, Civil Code § 1798.100 et seq.: California Privacy Protection Agency, Law and Regulations.
Key facts
Regulator
California Privacy Protection Agency (CalPrivacy)
Instrument
California Code of Regulations, Title 11, §§ 7000 et seq., the implementing regulations of the CCPA (Civil Code § 1798.100 et seq.)
2025 amendments
Adopted July 24, 2025. Approved September 22, 2025 (Office of Administrative Law). Effective January 1, 2026.
Article 11
For ADMT use for a significant decision before January 1, 2027: comply "no later than January 1, 2027". For such use on or after that date: comply at each time of use. Section 7200(b) dates.
Applies to
Businesses that use ADMT for a significant decision about a consumer, or process consumers' personal information that they intend to use to train such ADMT. Consumers include California-resident employees, job applicants, independent contractors, and students.
Other persons
Service providers, contractors, and third parties have duties. Section 7153 applies to a business that makes ADMT trained using personal information available to a recipient-business for a significant decision.
Enforced by
The Agency (administrative fines) and the Attorney General (civil penalties)
Modulos Frameworks
MFF-29 (AI System) and OFF-29 (Organization)
Which instrument is which
The Agency's CCPA regulations are the implementing regulations of the California Consumer Privacy Act. The instruments below are different. This information is correct as of October 2026.
| Instrument | Contents | As of October 2026 |
|---|---|---|
| California Consumer Privacy Act (CCPA), Civil Code § 1798.100 et seq. | The statute. It tells businesses which persons and information the CCPA applies to. It also gives the rights of consumers, the exemptions, and the enforcement rules. | It applies. The source is the statute as of January 1, 2026. The CCPA regulations are its implementing regulations. |
| CCPA regulations, California Code of Regulations, Title 11, §§ 7000 et seq. | The implementing regulations of the CCPA, from the Agency. See Provisions of the regulations. | It applies from January 1, 2026. The CCPA ADMT Regulations are the provisions of these regulations on ADMT and on risk assessments. |
| 2025 amendments to the CCPA regulations | The Agency uses the name "CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking Technology (ADMT) Regulations". With the amendments, the Agency adopted §§ 7120–7124, 7150–7157, 7200, 7220–7222, and 7270–7271, in Articles 9 to 12. It also amended sections in Articles 1 to 8 and 13. | Adopted by the Agency Board on July 24, 2025. Approved by the Office of Administrative Law on September 22, 2025. They apply from January 1, 2026. |
| California SB 947 (2025–2026), Chapter 859 | A different Labor Code statute on employers' use of automated decision systems. Section 1526.4 applies "Notwithstanding Section 1526.3", the notice rule of SB 947. An "employer" that is a CCPA business is "subject to any privacy-related automated decisionmaking technology regulation duly adopted by the California Privacy Protection Agency pursuant to Section 1798.185 and subdivision (b) of Section 1798.199.40 of the Civil Code". | Enacted on September 30, 2026 Operative July 1, 2027 (Labor Code § 1526.7) Outside the Modulos Frameworks |
| California AB 1018 (2025–2026) | A bill as amended in the Senate on August 21, 2026. | A bill. No source shows that it became law. See Possible changes. |
| Colorado SB 26-189 | A Colorado statute with different tests. | A Colorado law, not a California law. See Colorado SB 26-189. |
Provisions of the regulations
The Agency's CCPA regulations contain 13 articles. Each row below gives the sections and a link to the full rules.
| Article | Sections | Items | Section |
|---|---|---|---|
| Article 1, general provisions | §§ 7000–7004 | "Definitions" (§ 7001), limits on the purposes of processing, the quality of disclosures, and the methods for requests | Tests and purpose limits, disclosure quality, and request methods |
| Article 2, disclosures to consumers | §§ 7010–7016 | The privacy policy, the Notice at Collection, and the other notices | Pre-use Notice, opt-out, and access |
| Article 3, consumer requests | §§ 7020–7028 | Methods for requests and the time limits for the "response" | Time limits for requests |
| Article 4, service providers, contractors, and third parties | §§ 7050–7053 | The duties of these persons, and their contracts with a business | Service providers, contractors, and third parties |
| Article 5, verification | §§ 7060–7063 | Verification of requests, and the authorized agent | Pre-use Notice, opt-out, and access |
| Article 6, consumers "less than 16 years of age" | §§ 7070–7072 | Special rules for these consumers | Not in these sections |
| Article 7, non-discrimination | §§ 7080–7081 | Rules on non-discrimination, and the value of consumer data | Non-retaliation and non-discrimination |
| Article 8, training and records | §§ 7100–7102 | Training, records of requests, and more duties for a business with large quantities of personal information | Requests from consumers |
| Article 9, cybersecurity audits | §§ 7120–7124 | Cybersecurity audits | Not in the Modulos Frameworks |
| Article 10, risk assessments | §§ 7150–7157 | When a risk assessment is necessary, its contents, time limits, and the submissions to the Agency | Risk assessments and Agency submissions |
| Article 11, ADMT | §§ 7200–7222 | When Article 11 applies, the Pre-use Notice, the opt-out of ADMT, and access to ADMT | Pre-use Notice, opt-out, and access |
| Article 12, insurance companies | §§ 7270–7271 | How the CCPA applies to insurance companies | Exemptions and their conditions |
| Article 13, investigations and enforcement | §§ 7300–7304 | Procedures of the Agency | Enforcement |
Who the regulations apply to
Article 11 of the CCPA regulations applies to a business that "uses ADMT to make a significant decision concerning a consumer" (§ 7200(a)). See Who must comply for business, consumer, exemption, ADMT, and significant decision tests, and other persons with duties.
The duties in the regulations
The CCPA regulations give these duties to a business and to other persons. Each part below gives the duties in short, and refers to the section with the full rules.
Article 11 (ADMT). A business that uses ADMT for significant decisions about consumers has Article 11 duties for the Pre-use Notice, opt-out with exceptions, and access to ADMT. For use for a significant decision before January 1, 2027, the business must comply "no later than January 1, 2027". For such use on or after that date, the business must comply at each time of use (§ 7200(b)). See Pre-use Notice, opt-out, and access.
The three exceptions to the opt-out. A business can use a § 7221(b) exception only if it complies with all conditions of that exception. See The three exceptions, on their conditions.
Article 10 (risk assessments). A business must "conduct and document a risk assessment" for each processing activity in § 7150(b) (§ 7155). It must submit information about its risk assessments to the Agency (§ 7157). See Risk assessments and Agency submissions for the conditions and time limits.
Article 4 and § 7153. Article 4 (§§ 7050–7053) gives duties for businesses, service providers, contractors, and third parties. A business that makes "ADMT trained using personal information" available to a recipient-business for significant decisions must give all available facts necessary for that recipient-business's risk assessment (§ 7153). See Service providers, contractors, and third parties.
Dates
The Agency's CCPA regulations give the dates and time limits below. Each row gives a link to the full rule.
| Date or time limit | Applies to | Provision | Section |
|---|---|---|---|
| From January 1, 2026 | The 2025 amendments, with Article 10 and Article 11, become effective | Notice of approval of the Office of Administrative Law | Which instrument is which |
| Before the business starts the processing activity | A risk assessment for each processing activity in § 7150(b) | § 7155(a)(1) | Risk assessments |
| Not after January 1, 2027 | Article 11, for a business that uses ADMT for a significant decision before January 1, 2027 | § 7200(b) | When Article 11 applies |
| At all times when the business uses ADMT for a significant decision about a consumer | Article 11, for such use on or after January 1, 2027 | § 7200(b) | When Article 11 applies |
| Not after December 31, 2027 | A risk assessment for a processing activity that started before January 1, 2026 and continues after that date | § 7155(b) | Risk assessments |
| "At least once every three years" | The business must "review, and update as necessary" its risk assessments | § 7155(a)(2) | Risk assessments |
| "as soon as feasibly possible, but no later than 45 calendar days from the date of the material change" | The business must "update" the risk assessment after a material change | § 7155(a)(3) | Risk assessments |
| "for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later" | The business keeps its risk assessments, "including original and updated versions" | § 7155(c) | Risk assessments |
| Not after April 1, 2028 | The § 7157(b) information for risk assessments conducted in 2026 and 2027 | § 7157(a)(1) | Agency submissions |
| "no later than April 1 following any year during which the business conducted the risk assessments" | The § 7157(b) information for risk assessments conducted after 2027 | § 7157(a)(2) | Agency submissions |
| Not after 30 calendar days after the request | The risk assessment reports, if the Agency or the Attorney General tells the business to submit them | § 7157(e) | Agency submissions |
| "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request" | The business must comply with this time limit if the consumer "did not opt-out in response to the Pre-use Notice" and submits the request after processing starts. The business must stop the processing of that consumer's personal information with that ADMT. | § 7221(n) | Opt-out of ADMT |
| Not after 10 business days after it receives the request | A request to access ADMT or a request to appeal ADMT. The business tells the consumer that it has the request, and how it will process the request. | § 7021(a) | Time limits for requests |
| Not after 45 calendar days after it receives the request, or 90 calendar days on the conditions of § 7021(b) | The "response" to a request to access ADMT or a request to appeal ADMT | § 7021(b) | Time limits for requests |
| From July 1, 2027 | SB 947 becomes operative. SB 947 is a Labor Code statute, not part of the CCPA regulations. | Labor Code § 1526.7 | Which instrument is which |
Possible changes
The Agency can amend its CCPA regulations. The monetary thresholds and the California bill below are also items to monitor as of October 2026.
Agency rulemaking. As of October 2026, the regulations section of the Agency shows the 2025 amendments (September 2025) as one of its "Completed Regulation Packages". The Agency also gives this information: "The Agency does not have any proposed regulation packages at this time." In its Final Statement of Reasons, the Agency wrote that it "may revisit" three provisions "in future rulemaking packages as necessary to further enhance consumer privacy protections". The three provisions are ADMT (§ 7001(e)), significant decision (§ 7001(ddd)), and § 7200(a).
For the § 7200(a) threshold, the Agency wrote "may revisit this threshold".
AB 1018. AB 1018 (2025–2026) is a California bill. It was amended in the Senate on August 21, 2026. As of October 2026, no source shows that it became law.
Monetary thresholds. In Civil Code § 1798.199.95(d)(1), the Agency must adjust the monetary thresholds in §§ 1798.140(d)(1)(A), 1798.150(a)(1)(A), 1798.155(a), 1798.199.25, and 1798.199.90(a) "to reflect any increase in the Consumer Price Index". The Agency adjusts them on January 1, 2025, and on January 1 of each "odd-numbered year" after 2025. In § 1798.199.95(d)(3), the Agency "shall post the adjusted monetary thresholds on its internet website no later than January 15 of the year in which the adjustment becomes effective". As of October 2026, the adjusted thresholds that apply are the thresholds effective January 1, 2025.
These adjusted thresholds are $26,625,000 for the annual gross revenues for a business. For the administrative fines and the civil penalties, they are $2,663 and $7,988.
The section Operationalizing the CCPA ADMT Regulations in Modulos gives these items as items to monitor.
Enforcement
The Agency and the Attorney General enforce the CCPA regulations as part of the CCPA. Article 13 of the regulations (§§ 7300–7304) gives the procedures of the Agency: sworn complaints, investigations, probable cause proceedings, stipulated orders, and Agency audits.
Administrative fines. In Civil Code § 1798.155(a), a business, service provider, contractor, or other person that violates the CCPA is liable for an administrative fine in an administrative enforcement action "brought by the California Privacy Protection Agency". As adjusted effective January 1, 2025, the fine is not more than $2,663 for each violation. The maximum fine is $7,988 "for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age".
Civil penalties. In Civil Code § 1798.199.90(a), a business, service provider, contractor, or other person that violates the CCPA "shall be subject to an injunction and liable for a civil penalty". The civil penalty is "assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General". As adjusted effective January 1, 2025, the civil penalty is not more than $2,663 for each violation, or $7,988 "for each intentional violation and each violation involving the personal information of minor consumers". The court "may consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty".
Civil Code § 1798.199.100 also applies:
The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title. A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation.
The $7,988 maximum is for each "intentional violation" for administrative fines and civil penalties. For the conditions on personal information of minor consumers, the two provisions are different. For the administrative fine, the condition is actual knowledge that the consumers are "under 16 years of age". For the civil penalty, the condition is personal information of minor consumers. This condition does not refer to actual knowledge. See Possible changes for the adjustment rule.
The CCPA ADMT Regulations in Modulos
Modulos gives the CCPA ADMT Regulations as two Frameworks with the name CCPA ADMT Regulations:
MFF-29is for the AI System level. You add it to the AI System of one ADMT. Modulos recommends one AI System for each ADMT, but the regulations do not make this structure necessary.OFF-29is for the Organization level. You add it to the AI System of the type Organization.
For the Modulos CCPA Role values, see The CCPA Role tag. For the Controls that other Frameworks also use, see Control overlap.
The section Operationalizing the CCPA ADMT Regulations in Modulos gives the Requirements, the steps that Modulos recommends, and the items with no Control.
Where to go next
Coverage and roles
The business and the consumer, the CCPA exemptions, the ADMT and significant decision tests, and when Article 11 applies
Pre-use Notice, opt-out, and access
The Pre-use Notice, the opt-out and its three exceptions, access to ADMT, and the time limits for requests
Risk assessments and Agency submissions
When a risk assessment is necessary, its contents and time limits, and the submissions to the Agency
Service providers and ADMT suppliers
The duties of service providers, contractors, and third parties, their contracts, and the duty of § 7153
Operationalizing in Modulos
The two Frameworks, the Requirements, the CCPA Role tag, the steps, and the items to monitor
Frequently asked questions
Information about who must comply, dates, duties, enforcement, and Modulos, with a link to each full rule
FAQ about the CCPA ADMT Regulations
For information about the CCPA ADMT Regulations and a link to each full rule, see FAQ about the CCPA ADMT Regulations.
Sources
- CCPA regulations, effective January 1, 2026. California Code of Regulations, Title 11, Division 6, Chapter 1, §§ 7000–7304: the articles, and §§ 7001, 7021, 7150–7157, 7200–7222, and 7300–7304. California Privacy Protection Agency, Law and Regulations.
- The California Consumer Privacy Act, Civil Code § 1798.100 et seq., effective January 1, 2026: §§ 1798.140, 1798.155, 1798.199.90, 1798.199.95, and 1798.199.100. California Privacy Protection Agency, Law and Regulations.
- Notice of approval of the Office of Administrative Law (OAL Matter Number 2025-0808-04), September 22, 2025: the sections that the amendments adopted and amended, and the effective date.
- The Final Statement of Reasons of the Agency (September 2025): the date of adoption, and the information about
§§ 7001(e),7001(ddd), and 7200(a). The Final Statement of Reasons is not a source of duties. - The Law and Regulations section of the California Privacy Protection Agency: the "Completed Regulation Packages" and the "Proposed Regulations". Law and Regulations.
- Monetary thresholds: the section "Updated Monetary Thresholds in CCPA" of the California Privacy Protection Agency, effective January 1, 2025. Monetary thresholds in CCPA.
- California SB 947 (2025–2026), Chapter 859, approved on September 30, 2026: Labor Code §§ 1526.4 and 1526.7. SB 947, California Legislative Information.
- California AB 1018 (2025–2026), as amended in the Senate on August 21, 2026. AB 1018, California Legislative Information.
Disclaimer
This page gives general information. It is not legal advice. The 2025 amendments became effective on January 1, 2026, and Article 11 applies on the dates of § 7200(b). In its Final Statement of Reasons, the Agency wrote that it "may revisit" three provisions (see Possible changes).