Docs

Appearance

Frequently asked questions about the CCPA ADMT Regulations ​

Use this FAQ about the CCPA ADMT Regulations to find the applicable rules and their full conditions.

Disclaimer

This page gives general information. It is not legal advice.

What are the CCPA ADMT Regulations? ​

The CCPA ADMT Regulations are implementing regulations of the California Consumer Privacy Act (CCPA) for automated decisionmaking technology (ADMT). The California Privacy Protection Agency made them. They are in California Code of Regulations, Title 11, Division 6, Chapter 1.

The Agency adopted the 2025 amendments on July 24, 2025. The Office of Administrative Law approved them on September 22, 2025. They became effective January 1, 2026, with different compliance dates for Article 11 (§ 7200(b)) and Article 10 (§§ 7155, 7157). See the instrument and its dates.

What is automated decisionmaking technology (ADMT) under the CCPA regulations? ​

In § 7001(e) of the CCPA regulations, ADMT is "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking".

In § 7001(e)(1), "substantially replace human decisionmaking" is when "a business uses the technology’s output to make a decision without human involvement". Human involvement has three conditions for the human reviewer:

  • "Know how to interpret and use the technology’s output to make the decision".
  • "Review and analyze the output of the technology, and any other information that is relevant to make or change the decision".
  • "Have the authority to make or change the decision based on their analysis in subsection (B)".

ADMT includes profiling that replaces or substantially replaces human decisionmaking (§ 7001(e)(2)). ADMT does not include the types of technology in § 7001(e)(3), "provided that they do not replace human decisionmaking". See the ADMT test and its conditions.

What is a significant decision under the CCPA ADMT Regulations? ​

In § 7001(ddd) of the CCPA regulations, a significant decision is "a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services".

Only these five types count, with their conditions (§ 7001(ddd)(1)–(5)). Insurance is not one of these types. Advertising is not a significant decision (§ 7001(ddd)(6)). There is also an exception for housing decisions made "solely on the availability or vacancy of the housing or the successful receipt of payment for housing from the consumer" (§ 7001(ddd)(2)). See the significant decision test.

Who must comply with the CCPA ADMT Regulations? ​

Article 11 applies to a business that uses ADMT for a significant decision about a consumer (§ 7200(a), CCPA regulations). These other conditions and duties apply:

When must businesses comply with the CCPA ADMT Regulations? ​

The 2025 amendments became effective January 1, 2026. A business must comply with Article 11 by January 1, 2027 for use for a significant decision before that date. For such use on or after that date, compliance is necessary at each use (§ 7200(b)).

Article 10 has different time limits. A risk assessment is necessary before processing starts (§ 7155(a)(1)). For processing that started before January 1, 2026 and continues, the business must complete the assessment by December 31, 2027 (§ 7155(b)).

For assessments conducted in 2026–2027, the business must submit the information in § 7157(b) to the Agency by April 1, 2028 (§ 7157(a)(1)). For assessments conducted after 2027, it must submit that information by April 1 after each calendar year in which it conducted assessments (§ 7157(a)(2)). See Dates.

Do the CCPA ADMT Regulations apply to employees and job applicants? ​

Yes, if they are California residents and a CCPA business uses ADMT for a significant decision about them (§ 7200(a)). Independent contractors are also consumers (Civil Code § 1798.140(i)). Hiring, allocation of work, compensation, promotion, demotion, suspension, and termination are significant decisions (§ 7001(ddd)(4)).

Opt-out exceptions have conditions: human appeal (§ 7221(b)(1)), admission or hiring (§ 7221(b)(2)), and allocation of work or compensation (§ 7221(b)(3)). The last two have specified "solely" purposes and a condition on the result (§ 7221(b)(2)(B), (b)(3)(B)). Article 11 dates also apply (§ 7200(b)). SB 947 is a different Labor Code statute, operative July 1, 2027. In § 1526.4, an "employer" that is a CCPA business is "subject to any privacy-related automated decisionmaking technology regulation duly adopted by the California Privacy Protection Agency".

What must a business do when it uses ADMT for a significant decision? ​

The business must give a Pre-use Notice (§ 7220), give the opt-out unless an exception applies on its conditions (§ 7221(b)), and "respond to" access requests (§ 7222). For use for a significant decision before January 1, 2027, the business must comply with Article 11 "no later than January 1, 2027". For such use on or after that date, it must comply at each time of use (§ 7200(b)).

Other duties apply to request time limits (§ 7021), non-retaliation and non-discrimination (§§ 7221(l), 7222(k), 7080). See the Article 11 duties.

The business must also conduct a risk assessment before use starts (§§ 7150(b)(3), 7155(a)(1)). Processing started before 2026 that continues has a different time limit (§ 7155(b)).

What must a Pre-use Notice include? ​

The business's Pre-use Notice must give the "specific purpose", opt-out and access rights and request methods, non-retaliation, and how the ADMT works (§ 7220(c)). The last item includes the output, its use, and the alternative process unless a § 7221(b) exception applies.

Other rules apply to:

  • Alternative notice information for an opt-out exception (§ 7220(c)(2)(A)–(B)).
  • Time and method, also for information collected for a different purpose (§ 7220(b)).
  • The business is permitted to give the Pre-use Notice in its Notice at Collection, if that notice complies with § 7220(b)–(c) and includes all their information (§ 7220(a)).
  • Exceptions only for information about how the ADMT works (§ 7220(d)).
  • The business is permitted to give a "consolidated Pre-use Notice" if it includes the Article 11 information for each "proposed" use (§ 7220(e)).

See Pre-use Notice.

When does a business not have to offer an opt-out of ADMT? ​

Only if the business complies with all conditions of a § 7221(b) exception in the CCPA regulations:

  • Human appeal: reviewer authority, how to "interpret and use" output, "review and analyze" information, consumer information, methods, communications, time limits, and verification (§ 7221(b)(1)).
  • "Admission, acceptance, or hiring": the "solely" assessment purpose and the result condition (§ 7221(b)(2)).
  • Allocation of work or compensation: the "solely" purpose and the result condition (§ 7221(b)(3)).

For the last two, the ADMT must work for the business's purpose and must not "unlawfully discriminate based upon protected characteristics". The other duties continue: notice with alternative information, access, non-retaliation, and risk assessment. For use for a significant decision before January 1, 2027, the business must comply with Article 11 "no later than January 1, 2027". For such use on or after that date, it must comply at each time of use (§ 7200(b)). The risk assessment time limits also apply (§ 7155).

How fast must a business respond to a request to access or opt out of ADMT? ​

For access or appeal requests, the business must "confirm receipt" by 10 business days and "respond" by 45 calendar days after it receives the request (§ 7021). Verification, information, and extension conditions apply (§ 7021(a)–(b), Civil Code § 1798.145(h)). The maximum time, with an extension, is 90 calendar days from the date the business receives the request.

Section 7021 does not name opt-out requests. Before processing starts, a request prevents initiation (§ 7221(m)). After processing starts, § 7221(n) applies if the consumer "did not opt-out in response to the Pre-use Notice". Processing must stop "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request". Instructions to other persons and limits on verification also apply (§§ 7221(n)(2), (f), 7060(b)).

When is a risk assessment required for ADMT under the CCPA regulations? ​

A business must conduct and "document" a risk assessment before use for a significant decision or processing consumers' personal information it intends to use to train such ADMT (§§ 7150(b)(3), (6), 7155(a)(1)). The training rule applies also without use.

Other rules apply to:

  • Processing that started before January 1, 2026 and continues: the business must conduct and "document" the risk assessment by December 31, 2027 (§ 7155(b)).
  • The duty to "review, and update as necessary" at intervals of not more than "three years", the duty to "update" after a material change, and retention (§ 7155(a)(2)–(3), (c)).
  • Logic and output information for use (§ 7152(a)(3)(G)).
  • Approval by a person with "authority to participate in deciding whether the business will initiate the processing" (§ 7152(a)(9)).

See Risk assessments and Agency submissions for the conditions and time limits.

What must a business submit to the Agency about its risk assessments, and when? ​

The business submits information about its assessments, not the assessments or reports (§ 7157, CCPA regulations). It must submit by April 1, 2028 for assessments conducted in 2026–2027. For assessments conducted after 2027, it must submit by April 1 after each calendar year with assessments (§ 7157(a)).

The submission includes counts by processing activity, types of personal information, and an attestation "under penalty of perjury" (§ 7157(b)). The person who submits must be "a member of the business’s executive management team" who complies with all three conditions of § 7157(c). The business submits through the Agency's website (§ 7157(d)). The business must submit reports not after 30 calendar days from a request by the Agency or the Attorney General (§ 7157(e)). See Agency submissions for all information and conditions.

Do the CCPA ADMT Regulations apply to ADMT vendors and service providers? ​

The duties apply to service providers, contractors, third parties, and businesses, on the conditions below. The CCPA regulations give these duties:

  • Service providers and contractors: a § 7051(a) contract is necessary to be a service provider or contractor (§ 7050(e)). Duties to help with assessments and access requests apply (§§ 7050(h)(2), 7222(i)). A service provider or contractor that is a business must comply with the CCPA and the regulations for personal information it "collects, maintains, or sells outside of its role as a service provider or contractor" (§ 7050(d)).
  • Third parties: no processing of personal information that the business made available to the third party without a contract that complies with § 7053(a). The third party must comply with the contract (§ 7052).
  • A business that makes trained ADMT available: § 7153 applies only to "ADMT trained using personal information", made available to a recipient-business for significant decisions. All available facts necessary for the recipient-business's risk assessment must be given.

Opt-out instructions also apply on § 7221(n)'s conditions.

What are the penalties for violating the CCPA ADMT Regulations? ​

As adjusted effective January 1, 2025, CCPA enforcement has a $2,663 maximum for each violation, or $7,988 for these violations:

  • Agency administrative fines: "intentional" violations, or violations with consumers' personal information and actual knowledge that the consumers are "under 16 years of age" (Civil Code § 1798.155(a)).
  • Civil action of the Attorney General: "intentional" violations and violations with the personal information of minor consumers (§ 1798.199.90(a)). The person that violates the CCPA is also "subject to an injunction".

Section 1798.199.100 also applies: "The agency and any court, as applicable, shall consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of any administrative fine or civil penalty for a violation of this title." "A business shall not be required by the agency, a court, or otherwise to pay both an administrative fine and a civil penalty for the same violation." The adjustment rule and full enforcement conditions apply (§ 1798.199.95(d)).

Does California SB 947 change the CCPA ADMT Regulations? ​

No. SB 947 (Chapter 859, approved September 30, 2026) adds a different Labor Code statute on employers' use of automated decision systems. It becomes operative July 1, 2027 (§ 1526.7).

An "employer" that is a CCPA business is "subject to any privacy-related automated decisionmaking technology regulation duly adopted by the California Privacy Protection Agency" (§ 1526.4). This applies "Notwithstanding Section 1526.3", SB 947's notice rule. SB 947 is not in the Modulos Frameworks. See Which instrument is which.

Will the CCPA ADMT Regulations change? ​

Possibly. As of October 2026, the Agency has no "proposed regulation packages". Its Final Statement of Reasons names three provisions it "may revisit": the ADMT "definition" (§ 7001(e)), the significant decision "definition" (§ 7001(ddd)), and the § 7200(a) threshold.

AB 1018 (2025–2026) is a California bill. As of October 2026, no source shows that it became law.

The Agency adjusts the monetary thresholds of the CCPA on "January 1 of any odd-numbered year" (Civil Code § 1798.199.95(d)). As of October 2026, the thresholds from January 1, 2025 apply. See Possible changes.

How does Modulos model the CCPA ADMT Regulations? ​

Modulos gives the CCPA ADMT Regulations as two Frameworks with the name CCPA ADMT Regulations. You add MFF-29 to the AI System of one ADMT. You add OFF-29 to the organization AI System, at the Organization level.

Each Requirement has one or more values of the CCPA Role tag. These values are Modulos names for the persons in the CCPA and the regulations. These names are not terms of the law. One organization can be more than one of these types of person. See The CCPA Role tag.

For the Requirements and the steps that Modulos recommends, see The Requirements and Steps that Modulos recommends. For the Controls that other Frameworks also use, see Control overlap.