When the regulations apply

In § 7200(a) of the CCPA ADMT Regulations, Article 11 (§§ 7200–7222) applies to a business that uses ADMT to make a significant decision about a consumer. The test has five parts, and each part is necessary:

• The organization is a business.
• The person that the decision is about is a consumer.
• The information is personal information, and no CCPA exemption applies.
• The technology is ADMT.
• The decision is a significant decision.

Article 10 also applies to this use and a business's processing of consumers' personal information it intends to use to train such ADMT (Use and training, § 7150(b)(3), (6)).

The business and the consumer

Civil Code § 1798.140(d)(1) gives the business test. An entity is a business when all these conditions apply:

• The entity is "a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners".
• The entity "collects consumers' personal information, or on the behalf of which such information is collected".
• The entity, "alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information".
• The entity "does business in the State of California".
• The entity "satisfies one or more of the following thresholds" in § 1798.140(d)(1)(A)–(C).

The three thresholds are:

• "As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95". See Possible changes for the adjusted threshold and the adjustment rule.
• "Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households".
• "Derives 50 percent or more of its annual revenues from selling or sharing consumers' personal information".

The CCPA also makes three other types of entity a business (§ 1798.140(d)(2)–(4)):

• "Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers' personal information".
• "A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest".
• "A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title".

In the CCPA, a consumer is "a natural person who is a California resident", "however identified" (§ 1798.140(i)). Employees, job applicants, independent contractors, and students are consumers when they are California residents. Thus the regulations apply to a use of ADMT for decisions about these persons if all the other conditions apply.

Some of these uses have opt-out exceptions, each with its conditions (§ 7221(b)(2)–(3)). The human appeal exception (§ 7221(b)(1)) is available for all types of significant decision. The three exceptions, on their conditions gives the conditions.

In the CCPA, personal information is information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household" (§ 1798.140(v)(1)). Personal information does not include "publicly available information or lawfully obtained, truthful information that is a matter of public concern" (§ 1798.140(v)(2)(A)). It also does not include "consumer information that is deidentified or aggregate consumer information" (§ 1798.140(v)(3)).

Exemptions and their conditions

For a business, the CCPA exemptions in Civil Code §§ 1798.145 and 1798.146 apply only with their conditions. Some apply to types of information, some to types of entity and to how they keep patient information, and one to conduct with consumer reports. The insurance rule is in the CCPA regulations (§ 7271(a)).

In §§ 1798.145(c)(1)(B) and 1798.146(a)(2), the exemptions for providers of health care and covered entities apply to these types of entity:

• A provider of health care "governed by the Confidentiality of Medical Information Act".
• A covered entity "governed by the privacy, security, and breach notification rules".

These are the HIPAA rules of the United States Department of Health and Human Services in 45 C.F.R. Parts 160 and 164.

Exemption	Type and conditions
Medical information and protected health information	Information: "Medical information governed by the Confidentiality of Medical Information Act", or "protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules" of the Department of Health and Human Services for HIPAA (§ 1798.145(c)(1)(A) and § 1798.146(a)(1))
Providers of health care and covered entities (§ 1798.145(c)(1)(B))	Entity: the exemption applies "to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information" in § 1798.145(c)(1)(A).
Providers of health care and covered entities (§ 1798.146(a)(2))	Entity: the exemption applies "to the extent the provider or covered entity maintains, uses, and discloses patient information in the same manner as medical information or protected health information" in § 1798.146(a)(1).
Business associates (§ 1798.146(a)(3))	Entity: a business associate of a covered entity "governed by the privacy, security, and data breach notification rules". These are rules of the United States Department of Health and Human Services in 45 C.F.R. Parts 160 and 164. HIPAA and the Health Information Technology for Economic and Clinical Health Act are the laws for these rules. This exemption applies "to the extent that the business associate maintains, uses, and discloses patient information in the same manner as medical information or protected health information" in § 1798.146(a)(1).
Deidentified patient information	Information, on the two conditions in § 1798.146(a)(4)(A). The information "is deidentified in accordance with the requirements for deidentification" in 45 C.F.R. § 164.514. The information "is derived from patient information that was originally collected, created, transmitted, or maintained by an entity regulated by" HIPAA, the Confidentiality of Medical Information Act, or the Common Rule. The exemption stops for information that is "subsequently reidentified" (§ 1798.146(a)(4)(B)).
Research and clinical trials	Information: "Personal information collected as part of a clinical trial or other biomedical research study subject to, or conducted in accordance with," the Common Rule, the "good clinical practice guidelines issued by the International Council for Harmonisation", or the "human subject protection requirements" of the Food and Drug Administration. This exemption applies "provided that the information is not sold or shared in a manner not permitted by this subparagraph, and, if it is inconsistent, that participants be informed of that use and provide consent" (§ 1798.145(c)(1)(C)). Section 1798.146(a)(5) also gives an exemption for "Information that is collected, used, or disclosed in research". Research is "as defined" in 45 C.F.R. § 164.501. The research must comply with the "applicable ethics" and "confidentiality, privacy, and security rules" of 45 C.F.R. Part 164, the Common Rule, the "good clinical practice guidelines issued by the International Council for Harmonisation", or the "human subject protection requirements" of the United States Food and Drug Administration.
Consumer reports	Conduct: "an activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" by "a consumer reporting agency", by "a furnisher of information", and by "a user of a consumer report" (§ 1798.145(d)(1)). The exemption applies "only to the extent" that the "activity" "is subject to regulation under the Fair Credit Reporting Act" and the information "is not collected, maintained, used, communicated, disclosed, or sold except as authorized by the Fair Credit Reporting Act" (§ 1798.145(d)(2)).
The Gramm-Leach-Bliley Act, the California Financial Information Privacy Act, and the Farm Credit Act	Information: personal information "collected, processed, sold, or disclosed subject to" the Gramm-Leach-Bliley Act and its regulations, the California Financial Information Privacy Act, or the Farm Credit Act of 1971 (§ 1798.145(e))
The Driver's Privacy Protection Act	Information: personal information "collected, processed, sold, or disclosed pursuant to" the Driver's Privacy Protection Act of 1994 (§ 1798.145(f))
Insurance companies	Entity: insurance companies that are businesses in the CCPA "shall comply with the CCPA with regard to any personal information not subject to the Insurance Code and its regulations" (§ 7271(a)). For example, they must comply for personal information "that is collected for purposes not in connection with an insurance transaction".

The exemptions in § 1798.145(d), (e), and (f) do not apply to the civil action in § 1798.150 ("Personal Information Security Breaches"). These are:

• The consumer report exemption (§ 1798.145(d)(3)).
• The exemption for personal information "collected, processed, sold, or disclosed subject to" the Gramm-Leach-Bliley Act and its regulations, the California Financial Information Privacy Act, or the Farm Credit Act (§ 1798.145(e)).
• The Driver's Privacy Protection Act exemption (§ 1798.145(f)).

Three more provisions of Civil Code § 1798.145 limit the CCPA in some conditions. No one of them is a general exemption for the use of ADMT:

• Commercial conduct "wholly outside of California" (§ 1798.145(a)(1)(G)). The obligations of the CCPA do not prevent a business from the collection, sale, or sharing of personal information "if every aspect of that commercial conduct takes place wholly outside of California". Commercial conduct is "wholly outside of California" only on all of these conditions:
  • "the business collected that information while the consumer was outside of California"
  • "no part of the sale of the consumer's personal information occurred in California"
  • "no personal information collected while the consumer was in California is sold".
• Contraception, pregnancy care, and perinatal care (§ 1798.145(a)(2)). All of § 1798.145(a) does not apply if the personal information of the consumer "contains information related to accessing, procuring, or searching for services" about "contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services". This rule does not change "the use of aggregated or deidentified personal information consistent with a business purpose as defined in paragraphs (1), (2), (3), (4), (5), (7), or (8) of subdivision (e) of Section 1798.140", "provided that the personal information is only retained in aggregated and deidentified form and is not sold or shared". It also does not change "the duty of a business to preserve or retain evidence pursuant to California or federal law in an ongoing civil proceeding".
• Noncommercial activities (§ 1798.145(l)). The rights of consumers and the obligations of a business "shall not apply to the extent that they infringe on the noncommercial activities of a person or entity described in subdivision (b) of Section 2 of Article I of the California Constitution". Thus the limit is not general. It applies only "to the extent that" these rights and obligations "infringe on the noncommercial activities" of such a person or entity.

The technology test — ADMT

For a business that uses a technology, § 7001(e) of the CCPA regulations gives the ADMT test:

“Automated decisionmaking technology” or “ADMT” means any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.

Section 7001(e) does not refer to artificial intelligence. If a technology does not replace human decisionmaking, it is ADMT only if it substantially replaces human decisionmaking. That test is about human involvement, which § 7001(e)(1) gives:

For purposes of this definition, to “substantially replace human decisionmaking” means a business uses the technology’s output to make a decision without human involvement. Human involvement requires the human reviewer to: (A) Know how to interpret and use the technology’s output to make the decision; (B) Review and analyze the output of the technology, and any other information that is relevant to make or change the decision; and (C) Have the authority to make or change the decision based on their analysis in subsection (B).

Section 7001(e) gives these four points:

• All three parts are necessary. If the business has no human reviewer who does all of parts (A), (B), and (C), the business makes the decision without human involvement. Then the technology substantially replaces human decisionmaking.
• Each part applies as written. Part (B) applies to the output and to the other information "that is relevant to make or change the decision". In part (C), the authority to make the decision and the authority to change the decision are alternatives.
• Profiling can be ADMT. ADMT includes profiling that replaces human decisionmaking or substantially replaces human decisionmaking (§ 7001(e)(2)).
• Section 7001(e)(3) has a condition. ADMT does not include "web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, databases, and spreadsheets, provided that they do not replace human decisionmaking".

How Modulos reads the test. Modulos reads human involvement as a test of the decision process in which the business makes the decision. Thus a human reviewer who is available only after the decision, on appeal, does not remove a technology from the ADMT test. The ADMT test does not refer to an appeal. The human appeal exception (§ 7221(b)(1)) is an exception to the opt-out, with its conditions (The human appeal exception).

The decision test — significant decision

For a business that uses ADMT to make decisions about consumers, the CCPA regulations give the significant decision test in § 7001(ddd):

“Significant decision” means a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.

Only these five types are significant decisions. A significant decision does not include advertising to a consumer (§ 7001(ddd)(6)). Insurance is not one of the types. The conditions for each type are in § 7001(ddd)(1)–(5):

Type	Conditions
Financial or lending services	"the extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans"
Housing	"any building, structure, or portion thereof that is used or occupied as, or designed, arranged, or intended to be used or occupied as, a home, residence, or sleeping place by one or more consumers including for permanent or temporary occupancy". A use of ADMT that "provides or denies housing to a consumer" is not a significant decision if the ADMT does this "solely on the availability or vacancy of the housing or the successful receipt of payment for housing from the consumer".
Education enrollment or opportunities	"Admission or acceptance into academic or vocational programs", "Educational credentials (e.g., a degree, diploma, or certificate)", and "Suspension and expulsion"
Employment or independent contracting opportunities or compensation	"Hiring", the "allocation/assignment of work and compensation", "Promotion", and "Demotion, suspension, and termination". The "allocation/assignment of work and compensation" is the allocation or assignment of work for employees, or "salary, hourly" compensation, compensation for each "assignment", or "incentive compensation such as a bonus, or another benefit".
Healthcare services	"services related to the diagnosis, prevention, or treatment of human disease or impairment, or the assessment or care of an individual's health"

The CCPA regulations also give these two tests:

• Performance at work (§ 7001(cc)) is "the performance of job duties for which the consumer has been hired or has applied to be hired". It does not include "union membership or interest in unionizing", "interest in seeking other employment opportunities", or "location when off-duty or on breaks". It also does not include "use of a personal account", unless the purpose is "solely to prevent or limit the use of these accounts on the business's information system or to prevent the disclosure of confidential information".
• Performance in an educational program (§ 7001(dd)) is "the performance of coursework in an educational program in which the consumer is enrolled or has applied to be enrolled". It does not include the location of the consumer "when they are not performing coursework". It also does not include "use of a personal account", unless the purpose is "solely to prevent or limit the use of these accounts on the educational program provider's information system, including to prevent the disclosure of confidential information or to prevent cheating".

The regulations use "performance at work" for profiling (§ 7001(ii)) and in two risk-assessment processing activities (§ 7150(b)(4)–(5)). No other provision uses "performance in an educational program". The admission and hiring exception in § 7221(b)(2)(A) refers to "the consumer's ability to perform at work or in an educational program", and it does not use the terms as written in those provisions. The three exceptions, on their conditions gives that exception and how Modulos reads it.

Purpose limits on personal information

Section 1798.100(c) of the CCPA and § 7002(a) of the CCPA regulations set a purpose limit. The collection, use, retention, and sharing of the personal information of a consumer by a business must be "reasonably necessary and proportionate" for one of these purposes:

• "The purpose(s) for which the personal information was collected or processed". This purpose must agree with the reasonable expectations of the consumers, and § 7002(b) gives the "factors" for them.
• "Another disclosed purpose that is compatible with the context in which the personal information was collected".

Section 7002(c) uses three "factors" to find if a different disclosed purpose is compatible:

• the reasonable expectations of the consumers "At the time of collection of the personal information", with the § 7002(b) "factors"
• the other disclosed purpose
• the "strength of the link" between the two.

Section 7002 does not refer to ADMT. Its rules apply to all collection and processing of personal information. Thus they also apply when a business will use ADMT to process personal information that it collected before:

• Consent (§ 7002(e)). Before a business collects or processes personal information for a purpose that does not agree with § 7002(a), it must get the consent of the consumer. That consent must agree with § 7004. "Except as set forth Civil Code section 1798.145, subdivision (r), or as otherwise prohibited by the CCPA, a consumer must be able to withdraw consent at any time."
• Reasonably necessary and proportionate (§ 7002(d)). For each purpose, and for each purpose with consent, the processing must be reasonably necessary and proportionate. The "factors" are "The minimum personal information that is necessary", "The possible negative impacts on consumers", and "additional safeguards for the personal information to specifically address the possible negative impacts on consumers".
• A new Notice at Collection (§ 7002(f)). A business must not collect types of personal information other than the types in its Notice at Collection. If a business "intends to collect" more types of personal information, or "intends to use" personal information for purposes "incompatible with the disclosed purpose", it must give a new Notice at Collection. The new collection or processing must also comply with § 7002(a)–(e).

Section 7002 sets these limits and tests, but no duty to make an assessment report or to keep records. A Pre-use Notice does not replace these limits. For personal information collected for a different purpose, the business must give the Pre-use Notice before ADMT processing to make a significant decision about a consumer (§ 7220(b)(2)). This duty has the Article 11 compliance dates in § 7200(b).

Service providers, contractors, and third parties

The CCPA identifies three types of persons that process or receive personal information in relation to a business:

• Service provider — in Civil Code § 1798.140(ag)(1), a person "that processes personal information on behalf of a business and that receives from or on behalf of the business consumer's personal information for a business purpose pursuant to a written contract". Section 1798.140(ag)(1) gives the clauses that this contract must have.
• Contractor — in § 1798.140(j)(1), "a person to whom the business makes available a consumer's personal information for a business purpose, pursuant to a written contract with the business". Section 1798.140(j)(1) gives the clauses that this contract must have.
• Third party — in § 1798.140(ai), a person who is not a service provider to the business, not a contractor, and not "the business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumer's current interaction with the business".

One organization can be more than one of these types of person. A service provider or contractor that is a business must comply with the CCPA and the regulations for all personal information that it "collects, maintains, or sells outside of its role as a service provider or contractor" (§ 7050(d)).

In § 7153 of the CCPA regulations, a business that makes ADMT "trained using personal information" available to a different business for significant decisions has duties to that recipient-business.

When Article 11 applies

Article 11 of the CCPA regulations applies to a business that uses ADMT to make a significant decision about a consumer (§ 7200(a)). Section 7200(b) sets two time limits:

A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027. A business that uses ADMT on or after January 1, 2027, must be in compliance with the requirements of this Article any time it is using ADMT for a significant decision.

Section 7200(b) refers only to Article 11. If a business first uses ADMT for a significant decision on or after January 1, 2027, it gets no more time.

Article 10 applies from January 1, 2026, with risk-assessment dates in § 7155 that § 7200(b) does not change.

The coverage determination in Modulos

In Modulos, MFF-29 is the CCPA ADMT Regulations Framework at the AI System level. It has the coverage determination as the Requirement MRF-489 (Coverage determination). The regulations set no duty to record the coverage determination and no time interval to do it again. Steps that Modulos recommends tells you when to do the coverage determination again. The Requirements shows all Requirements of the two Frameworks.

Where to go next

• Pre-use Notice, opt-out, and access — the Article 11 duties of a business that uses ADMT for a significant decision.
• Risk assessments and Agency submissions — the Article 10 duties for the use of ADMT and for training.
• Service providers and the section 7153 duty — the Article 4 duties and the section 7153 duty.
• The Frameworks in Modulos — the AI System structure, the Requirements, and the steps that Modulos recommends.

Disclaimer

This page gives general information. It is not legal advice.