Appearance
Coverage and roles
The Article 11 duties in the CCPA ADMT Regulations hang on one determination: does a business use ADMT to make a significant decision concerning a consumer (§ 7200(a))? The test is conjunctive: business, consumer, personal information in scope, ADMT, significant decision. A separate determination asks whether the business processes personal information it intends to use to train such ADMT, which triggers the Article 10 risk assessment on its own (§ 7150(b)(6)). Neither is a risk-tiering exercise, and neither turns on whether the technology is called AI. MFF-29 carries the determination as MRF-489, tagged CCPA Role: Business using ADMT.
The business and the consumer
A business is defined by Civ. Code § 1798.140(d): a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information (or on whose behalf it is collected), alone or jointly with others determines the purposes and means of the processing, does business in California, and satisfies one or more of three thresholds: as of January 1 of the calendar year, annual gross revenues in the preceding calendar year in excess of the § 1798.140(d)(1)(A) figure of $25,000,000 as adjusted ($26,625,000 since January 1, 2025); alone or in combination, annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information. Three further routes reach business status: an entity that controls or is controlled by such a business, shares common branding with it, and with whom it shares consumers' personal information; a joint venture or partnership of businesses each holding at least a 40 percent interest; and a person doing business in California, not covered by the other routes, that voluntarily certifies to the Agency that it complies with and is bound by the CCPA (§ 1798.140(d)(2)–(4)). The Agency adjusts the revenue figure in odd-numbered years to reflect any increase in the Consumer Price Index, next effective January 1, 2027.
A consumer is any natural person who is a California resident, however identified (§ 1798.140(i)). Employees, job applicants, independent contractors, and students are consumers. An ADMT that screens applicants, assigns shifts, sets incentive pay, or admits students is inside the regulations on the same terms as one that decides a loan.
Personal information identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (§ 1798.140(v)(1)). It excludes publicly available information and lawfully obtained, truthful information that is a matter of public concern, and deidentified or aggregate consumer information (§ 1798.140(v)(2)–(3)).
The exemptions carry conditions
The CCPA's exemptions are tested against the information processed, and each has its own limits (Civ. Code §§ 1798.145, 1798.146):
| Exemption | Condition |
|---|---|
| Medical information and protected health information | Medical information governed by the Confidentiality of Medical Information Act, or protected health information collected by a covered entity or business associate governed by the HIPAA privacy, security, and breach notification rules (§ 1798.145(c)(1)(A); § 1798.146(a)(1)) |
| Providers of health care and HIPAA covered entities | To the extent they maintain patient information in the same manner as medical information or protected health information (§ 1798.145(c)(1)(B)); providers, covered entities, and business associates to the extent they maintain, use, and disclose patient information in the same manner (§ 1798.146(a)(2)–(3)) |
| Patient-derived deidentified information | Deidentified in accordance with 45 C.F.R. § 164.514 and derived from patient information originally collected, created, transmitted, or maintained by an entity regulated by HIPAA, the Confidentiality of Medical Information Act, or the Common Rule; the exemption ends on reidentification (§ 1798.146(a)(4)) |
| Research and clinical-trial information | On the § 1798.145(c)(1)(C) and § 1798.146(a)(5) conditions |
| Consumer-report activity | Only for qualifying actors regulated by the Fair Credit Reporting Act, using the information as that act authorizes (§ 1798.145(d)) |
| Gramm-Leach-Bliley Act, California Financial Information Privacy Act, and Farm Credit Act information | § 1798.145(e) |
| Driver's Privacy Protection Act information | § 1798.145(f) |
| Insurance | Actor-specific, not a free-standing information exemption: an insurance company that independently meets the business definition complies with the CCPA for personal information not subject to the Insurance Code and its regulations, for example information collected for purposes not connected with an insurance transaction (§ 7271(a)) |
Two further provisions are limits, not exclusions of ADMT use. The wholly-outside-California rule reaches collecting, selling, or sharing only, and only where every aspect of that commercial conduct takes place wholly outside California: the business collected the information while the consumer was outside California, no part of the sale of the consumer's personal information occurred in California, and no personal information collected while the consumer was in California is sold (§ 1798.145(a)(1)(G)). The whole of § 1798.145(a) is disapplied where the consumer's personal information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services, without altering the use of aggregated or deidentified personal information consistent with the listed business purposes, provided that it is retained only in aggregated and deidentified form and is not sold or shared, or the duty to preserve evidence under California or federal law in an ongoing civil proceeding (§ 1798.145(a)(2)(A)–(C)). And the rights afforded to consumers and the obligations imposed on a business do not apply to the extent that they infringe on the noncommercial activities of a person or entity described in Cal. Const. art. I, § 2(b), the identified press and broadcast persons and entities; the limit operates only to that extent and is not a blanket exclusion for noncommercial speech (§ 1798.145(l)).
The technology test — ADMT
“Automated decisionmaking technology” or “ADMT” means any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.
The definition has no AI threshold. A rules-based scoring engine, a decision tree, and a machine-learning model qualify on the same terms. What decides the question is human involvement (§ 7001(e)(1)), verbatim:
For purposes of this definition, to “substantially replace human decisionmaking” means a business uses the technology’s output to make a decision without human involvement. Human involvement requires the human reviewer to: (A) Know how to interpret and use the technology’s output to make the decision; (B) Review and analyze the output of the technology, and any other information that is relevant to make or change the decision; and (C) Have the authority to make or change the decision based on their analysis in subsection (B).
Four points shape the test:
- All three parts must hold, in the original decision flow. A reviewer who lacks any one of (A), (B), or (C) leaves the technology in scope. A reviewer available only after the decision, on appeal, never takes it out: the human-appeal route is an exception to the opt-out (
MRF-492), not a scoping argument. - The elements bind on their own terms. Information that is not relevant to make or change the decision need not be reviewed, and authority to make the decision is an alternative to authority to change it ((e)(1)(B)–(C)).
- Profiling is included where it replaces or substantially replaces human decisionmaking ((e)(2)).
- The utility exclusion is conditional ((e)(3)): web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, databases, and spreadsheets are not ADMT, provided that they do not replace human decisionmaking. A spreadsheet whose formula makes the decision is not saved by the list.
The organization-level capability behind a human-involvement claim (trained reviewers in the decision flow, with authority) is ORF-489; see Pre-use Notice, opt-out, and access.
The decision test — significant decision
“Significant decision” means a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.
The list is closed. There is no general test for decisions with "legal or similarly significant effects", advertising to a consumer is carved out ((ddd)(6)), and insurance is not on the list. Each category has its own subdefinition ((ddd)(1)–(5)):
| Category | Subdefinition |
|---|---|
| Financial or lending services | The extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans |
| Housing | Any building, structure, or portion of one that is used or occupied as, or designed, arranged, or intended to be used or occupied as, a home, residence, or sleeping place by one or more consumers, permanent or temporary; an ADMT that provides or denies housing based solely on the availability or vacancy of the housing or the successful receipt of payment for housing from the consumer is not making a significant decision |
| Education enrollment or opportunities | Admission or acceptance into academic or vocational programs; educational credentials (a degree, diploma, or certificate); suspension and expulsion |
| Employment or independent contracting opportunities or compensation | Hiring; allocation or assignment of work for employees, or salary, hourly or per-assignment compensation, incentive compensation such as a bonus, or another benefit ("allocation/assignment of work and compensation"); promotion; demotion, suspension, and termination |
| Healthcare services | Services related to the diagnosis, prevention, or treatment of human disease or impairment, or the assessment or care of an individual's health |
Two further definitions bound what a hiring or admission assessment may look at, and they matter for the § 7221(b)(2) exception (MRF-493): performance at work (§ 7001(cc)) is the performance of job duties for which the consumer has been hired or has applied, excluding union membership or interest in unionizing, interest in seeking other employment, off-duty and break location, and personal-account use (unless solely to prevent or limit use of those accounts on the business's information system or to prevent disclosure of confidential information); performance in an educational program (§ 7001(dd)) is the performance of coursework in a program the consumer is enrolled in or has applied to, excluding personal-account use (unless solely to prevent or limit the use of those accounts on the educational program provider's information system, including to prevent the disclosure of confidential information or to prevent cheating) and the consumer's location when they are not performing coursework.
The training trigger
Independently of any use, processing consumers' personal information that the business intends to use to train an ADMT for a significant decision is a significant-risk activity (§ 7150(b)(6)) for which the business must conduct a risk assessment before initiating it (§ 7150(a); § 7155(a)(1)), or by December 31, 2027 where the processing began before January 1, 2026 and continues (§ 7155(b)). "Intends to use" means the business is using, plans to use, permits others to use, plans to permit others to use, is advertising or marketing the use of, or plans to advertise or market the use of the ADMT. "Train" is the process through which a technology discovers underlying patterns, learns a series of actions, or is taught to generate a desired output (§ 7001(fff)). A business that only trains owes the risk assessment (MRF-495) and, where it makes ADMT trained using personal information available to another business to make a significant decision, the § 7153 duty to provide all facts available to it that the recipient-business's own risk assessment needs (MRF-496); the Article 11 duties attach only to use.
Repurposing already-collected information
Processing already-collected personal information with an ADMT must be reasonably necessary and proportionate to achieve either the purpose for which the information was collected or processed, which must be consistent with the consumers' reasonable expectations on the § 7002(b) factors, or another disclosed purpose compatible with the context in which the information was collected, judged on those reasonable expectations, the other disclosed purpose, and the strength of the link between the two (Civ. Code § 1798.100(c); § 7002(a)–(d)). Where the ADMT use meets neither, the business must obtain § 7004-compliant consent before processing for it, and the consumer must be able to withdraw that consent at any time except as set forth in Civ. Code § 1798.145(r) or as otherwise prohibited by the CCPA (§ 7002(e)); the processing must still be reasonably necessary and proportionate to that consented purpose on the § 7002(d) factors (the minimum personal information necessary, the possible negative impacts, and the safeguards addressing them). A business that intends to collect additional categories of personal information, or to use personal information for additional purposes incompatible with the disclosed purpose for which it was collected, must provide a new Notice at Collection, and the additional collecting or processing must still satisfy § 7002(a)–(e) (§ 7002(f)). The Pre-use Notice does not authorize the processing. MRF-489 concludes these questions per technology; the enterprise program is ORF-491.
The four CCPA roles
Template version 1.0.32 adds one tag family, CCPA Role, with four values attached directly to the Requirements. The roles are deliberately non-exclusive: the same organization can be a business for one technology and a service provider, contractor, third party, or ADMT supplier for another.
| Role | Definition | Where it is tested |
|---|---|---|
| Business using ADMT | A business within Civ. Code § 1798.140(d) that uses ADMT to make a significant decision about a consumer (the Article 11 duties), or that processes personal information it intends to use to train ADMT for significant decisions (the Article 10 trigger) | Every Requirement |
| Service provider or contractor | A service provider (§ 1798.140(ag): a person that processes personal information on behalf of a business and receives it from or on behalf of the business for a business purpose under a written contract with the prescribed terms) or a contractor (§ 1798.140(j): a person to whom the business makes personal information available for a business purpose under such a contract), including for personal information processed with the ADMT or intended to train it; one that independently meets the business definition carries the business duties for ADMT it uses for its own significant decisions | MRF-496 |
| Third party | A third party within § 1798.140(ai): a person who is not the business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumer's current interaction, not a service provider to the business, and not a contractor. The framework tests the role where such a person receives personal information the business made available for processing with the ADMT (§ 7052); one that independently meets the business definition carries the business duties for its own uses | MRF-496 |
| ADMT supplier | A business that makes ADMT trained using personal information available to another business, the recipient-business, to make a significant decision, and must therefore provide to the recipient-business all facts available to it that are necessary for the recipient-business's own risk assessment (§ 7153); an ADMT supplier is also a business using ADMT wherever it uses the technology for its own significant decisions | MRF-495, MRF-496 |
→ The duties of each role: Service providers and ADMT suppliers.
When it applies
Article 11 applies to a business that uses ADMT to make a significant decision concerning a consumer (§ 7200(a)), on two timing branches, verbatim:
A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027. A business that uses ADMT on or after January 1, 2027, must be in compliance with the requirements of this Article any time it is using ADMT for a significant decision.
A 2026 use without the Article 11 apparatus is therefore not yet a violation, and a use first begun on or after January 1, 2027 has no grace period. Article 10 has applied since January 1, 2026: a risk assessment is conducted before initiating a newly covered activity (§ 7155(a)(1)), and an activity begun before January 1, 2026 that continues must be assessed no later than December 31, 2027 (§ 7155(b)). The Article 11 branches do not move the Article 10 dates.
How this maps in Modulos — MRF-489
MRF-489 (Coverage determination) asks the project to determine, and keep current, whether the CCPA ADMT Regulations reach this technology: whether the organization is a business, whether the affected people are consumers, whether the information is personal information in scope after the exclusions and conditional exemptions, whether the technology is ADMT under the three-part human-involvement test, and whether the decision is a significant decision; and, separately, whether the business processes personal information it intends to use to train such ADMT. The conclusion governs which other Requirements apply: MRF-490 to MRF-494 apply only where the ADMT is used for a significant decision, MRF-495 carries the risk assessment on either limb, and MRF-496 the role duties.
The Requirement is carried by the new Control MCF-695 (CCPA ADMT coverage determination). The regulations impose no scoping-documentation duty and no review cadence for the determination itself; a dated record of the conclusion and its rationale is the evidence practice the Control provides. The events that force fresh analysis are the risk-assessment ones in § 7155: a newly covered activity needs its assessment before initiation ((a)(1)), assessments are reviewed, and updated as necessary, at least once every three years ((a)(2)), and a material change requires an update as soon as feasibly possible and no later than 45 calendar days after the change ((a)(3)); re-running the determination alongside them is practice. A conclusion that the regulations do not apply is a valid outcome and is what makes the conditional Requirements not applicable.
Where to go next
- Pre-use Notice, opt-out, and access — the Article 11 duties that follow a positive determination.
- Risk assessments and Agency submissions — the Article 10 duty on either limb.
- Service providers and ADMT suppliers — what each of the four roles owes.
- Operationalizing the CCPA ADMT Regulations in Modulos — the full
MFF-29/OFF-29rollout.
Disclaimer
This page is for general informational purposes and does not constitute legal advice. The CCPA's monetary thresholds are adjusted in odd-numbered years, next effective January 1, 2027. Always verify against the current published text and consult qualified advisers.