Docs

Appearance

Pre-use Notice, opt-out, and access ​

Article 11 of the CCPA ADMT Regulations (§§ 7200–7222) applies to a business that uses ADMT to make a significant decision about a consumer (§ 7200(a)). For the tests for ADMT and for a significant decision, see the ADMT test and the significant decision test. Article 11 gives that business three duties: the Pre-use Notice (§ 7220), the opt-out of ADMT (§ 7221), and access to ADMT (§ 7222).

Section 7200(b) gives the date. A business that uses ADMT for a significant decision before January 1, 2027 must comply with Article 11 on or before January 1, 2027. A business that uses ADMT on or after January 1, 2027 must comply "any time it is using ADMT for a significant decision". See When Article 11 applies.

An exception in § 7221(b) removes the opt-out duty and changes the notice information.

Pre-use Notice ​

In § 7220(a) of the CCPA regulations, a business to which § 7200(a) applies must give consumers a Pre-use Notice. The Pre-use Notice must tell consumers about the use of ADMT and about their rights to opt out of ADMT and to access ADMT. The business is permitted to give the Pre-use Notice in its Notice at Collection. If the business does this, the Notice at Collection must comply with § 7220(b) and (c) and include all their information.

Article 2 duties. In § 7010(a), each business that must comply with the CCPA and the regulations must give a privacy policy. The privacy policy must comply with the CCPA and § 7011. A business that controls the collection of a consumer’s personal information from a consumer must give a Notice at Collection (§ 7010(b)). That notice must comply with the CCPA and § 7012 and include the information in § 7012(e)(1)–(6). These duties apply independently of Article 11.

Section 7010(d) adds a link. Unless the business uses an exception in § 7221(b), the Pre-use Notice must include an opt-out link. The link must agree with § 7221(c)(1).

When and how to give the notice (§ 7220(b)). All of these conditions apply to the Pre-use Notice:

  1. It complies with § 7003(a)–(b) ((b)(1)). The rules of § 7003 come after these items.
  2. It is "presented prominently and conspicuously to the consumer at or before the point when the business collects the consumer’s personal information that the business plans to process using ADMT" ((b)(2)).
  3. The business gives it "in the manner in which the business primarily interacts with the consumer" ((b)(3)).

Section 7220(b)(2) also gives a different time limit. The business can collect the personal information for a different purpose. If it "subsequently plans to process it using ADMT" for the § 7200(a) purpose, it must give the Pre-use Notice before that processing. Section 7002 also limits the purposes for which a business processes personal information. See Purpose limits on personal information.

Rules for disclosures and notices. In § 7003(a) of the CCPA regulations, disclosures and "communications to consumers" must be "easy to read and understandable to consumers". For example, they use "plain, straightforward language" and no "technical or legal jargon". These rules apply independently of Article 11.

Section 7003(b) adds three rules for the disclosures that a business must give in Article 2. Section 7220(b)(1) applies § 7003(a)–(b) to the Pre-use Notice. The three rules in § 7003(b) are:

(1) Use a format that makes the disclosure readable, including on smaller screens, if applicable. (2) Be available in the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements, and other information to consumers in California. (3) Be reasonably accessible to consumers with disabilities. For notices provided online, the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Web Consortium, incorporated herein by reference. In other contexts, the business shall provide information on how a consumer with a disability may access the policy in an alternative format.

Items of the notice (§ 7220(c)). The Pre-use Notice must include all of these items:

ItemThe Pre-use Notice must include
(1) Purpose"A plain language explanation of the specific purpose for which the business plans to use the ADMT." The business "must not describe the purpose in generic terms", for example "to make a significant decision" without more information.
(2) Opt-out"A description of the consumer’s right to opt-out of ADMT and how the consumer can submit a request to opt-out of ADMT." If the business uses an exception, item (2) changes. See the two rules after these items.
(3) Access"A description of the consumer’s right to access ADMT with respect to the consumer and how the consumer can submit their request to access ADMT to the business."
(4) Non-retaliation"That the business is prohibited from retaliating against consumers for exercising their CCPA rights."
(5) How the ADMT works"Additional information about how the ADMT works to make a significant decision about consumers, and how the significant decision would be made if a consumer opts out." This item must give a "plain language explanation" of three points. (A) How the ADMT processes personal information to make a significant decision, and the categories of personal information that have an effect on the output. (B) The type of output, and how the business uses it to make a significant decision. (C) The alternative process for consumers who opt out, unless an exception in § 7221(b) applies. The business is permitted to give item (5) "via a simple and easy-to-use method (e.g., a layered notice or hyperlink)".

When the business uses an exception (§ 7220(c)(2)(A)–(B)). These two rules replace item (2):

(A) If the business is not required to provide the ability to opt-out because it is relying upon the human appeal exception set forth in section 7221, subsection (b)(1), the business must instead inform the consumer of their ability to appeal the decision and provide instructions to the consumer on how to submit their appeal.

(B) If the business is not required to provide the ability to opt-out because it is relying upon another exception set forth in section 7221, subsection (b), the business must identify the specific exception it is relying upon.

An exception changes item (2). It does not remove the Pre-use Notice.

Limits for item (5) (§ 7220(d)). Section 7220(d) gives limits that apply to the item (5) information only:

In providing the information required by subsection (c)(5), a business’s Pre-use Notice is not required to include: (1) Trade secrets, as defined in Civil Code section 3426.1, subdivision (d); or (2) Information that would compromise the business’s ability to: (A) Prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; (B) Resist malicious, deceptive, fraudulent, or illegal actions directed at the business or at consumers, or to prosecute those responsible for those actions; or (C) Ensure the physical safety of natural persons.

These limits do not apply to items (1) to (4).

One notice for more than one use (§ 7220(e)). A business is permitted to give one "consolidated Pre-use Notice" for one of these:

  • one ADMT that the business uses for more than one purpose
  • more than one ADMT that the business uses for one purpose
  • more than one ADMT that the business uses for more than one purpose
  • the "systematic use" of one ADMT.

This is permitted only if the notice "includes the information required by this Article for each of the business’s proposed uses of ADMT".

Opt-out of ADMT ​

Section 7221(a) of the CCPA regulations gives the basic duty of a business that uses ADMT for a significant decision:

A business must provide consumers with the ability to opt-out of the use of ADMT to make a significant decision concerning the consumer, except as set forth in subsection (b).

Methods (§ 7221(c)). The business must give "two or more designated methods for submitting requests to opt-out of ADMT". To select the methods, the business "must consider the methods by which it interacts with consumers, the manner in which the business uses the ADMT, and the ease of use by the consumer". Also, "At least one method offered must reflect the manner in which the business primarily interacts with the consumer." Section 7221(c)(1) gives the minimum method:

A business that interacts with consumers online must, at a minimum, allow consumers to submit requests to opt-out through an interactive form accessible via an opt-out link that is provided in the Pre-use Notice. The link title must state what the consumer is opting out of, such as “Opt-out of Automated Decisionmaking Technology.”

Section 7221(c)(3) gives examples of other methods: "a toll-free phone number, a designated email address, a form submitted in person, and a form submitted through the mail". Section 7221(c)(4) gives this limit:

A notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of the business’s use of ADMT because cookies concern the collection of personal information and not necessarily the use of ADMT. An acceptable method for submitting requests to opt-out must be specific to the right to opt-out of the business’s use of the ADMT.

Rules for requests to opt-out of ADMT (§ 7221(d)–(m)):

ProvisionRule for the business
Easy methods ((d))The methods "must be easy for consumers to execute, must require minimal steps, and must comply with section 7004".
No account ((e))The business "must not require a consumer submitting a request to opt-out of ADMT to create an account or provide additional information beyond what is necessary to direct the business to opt-out the consumer".
No verifiable consumer request ((f), § 7060(b))The business "must not require a verifiable consumer request". It also must not make the consumer verify who they are (§ 7060(b)). The business "may ask the consumer for information necessary to complete the request", for example "information necessary to identify the consumer whose information is subject to the business’s use of ADMT". This "shall not be burdensome on the consumer" (§ 7060(b)). If the business can comply without more information, it must comply without it. For example, the business "may ask the consumer for their name, but it shall not require the consumer to take a picture of themselves with their driver’s license" (§ 7060(b)).
Fraudulent requests ((g))If the business has a "good-faith, reasonable, and documented belief" that a request is fraudulent, it is permitted to reject the request. It must then tell the requestor that it will not comply. It also "must provide to the requestor an explanation why it believes the request is fraudulent".
Processed requests ((h))The business must give a method that lets the consumer make sure that the business processed the request.
Selection of uses ((i))The business "may present the consumer with the choice to allow specific uses of ADMT as long as the business also offers a single option to opt-out of all of the business’s uses of ADMT set forth in subsection (a)". The "single option" applies to the business’s uses of ADMT to make significant decisions (§ 7221(a)).
Authorized agent ((j))A consumer is permitted to use an authorized agent if the consumer gives the agent "written permission signed by the consumer". The business is permitted to reject a request from an agent that does not give the business "the consumer’s signed permission".
"12 months" ((k))"Except as allowed by these regulations", the business must wait a minimum of "12 months" from the date it receives the request. Only after that period can it try to get the consent of the consumer to that ADMT again.
Non-retaliation ((l))The business "must not retaliate against a consumer because the consumer exercised their opt-out right" (Civil Code § 1798.125 and Article 7). See Non-retaliation and non-discrimination.
Request before the processing starts ((m))If the consumer submits the request before the business "has initiated that processing", the business "must not initiate processing of the consumer’s personal information using that ADMT".

Request after the processing starts (§ 7221(n)). This rule applies if the consumer "did not opt-out in response to the Pre-use Notice", and then submits a request to opt-out of ADMT after the business started the processing. The business must comply with the request with these two steps:

  1. The business must cease to process the personal information of the consumer with that ADMT "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request" ((n)(1)).
  2. The business must notify "all the business’s service providers, contractors, or other persons to whom the business has disclosed or made personal information available to process the consumer’s personal information using that ADMT" ((n)(2)). The notice tells them "that the consumer has made a request to opt-out of that ADMT". It also tells them to comply with the request "within the same time frame".

The duty in § 7221(n)(2) is a duty of the business. Service providers, contractors, and third parties also have duties in Article 4, for example § 7050(f) and § 7052(b). See the contracts with service providers and third parties.

The three exceptions, on their conditions ​

Section 7221(b) of the CCPA regulations gives three exceptions in which a business "is not required to provide consumers with the ability to opt-out". A business can use an exception only if all the conditions of that exception apply. An exception removes the opt-out duty and changes item (2) of the Pre-use Notice (§ 7220(c)(2)). The opt-out link (§ 7010(d)), item (5)(C) (§ 7220(c)(5)(C)), and the privacy policy opt-out information (§ 7011(e)(2)(F)) are not necessary.

The Pre-use Notice, access to ADMT, non-retaliation, and the Article 10 risk assessment stay (§§ 7220(a), 7222, 7080, 7150(b)(3)). The Article 11 dates apply: for use for a significant decision before January 1, 2027, the business must comply by that date. For such use from January 1, 2027, the business must comply at each use (§ 7200(b)).

ExceptionSignificant decisions to which it appliesConditions
Human appeal exception ((b)(1))All significant decisionsA method of appeal to a human reviewer, and the conditions of § 7221(b)(1)(A)–(B). See The human appeal exception.
Admission, "acceptance", or hiring ((b)(2))Only "admission or acceptance into academic or vocational programs" (§ 7001(ddd)(3)(A)) and "hiring" (§ 7001(ddd)(4)(A))Conditions (A) and (B) of § 7221(b)(2). See The exceptions in section 7221(b)(2) and (b)(3).
Allocation of work and compensation ((b)(3))Only "allocation/assignment of work and compensation" (§ 7001(ddd)(4)(B))Conditions (A) and (B) of § 7221(b)(3). See The exceptions in section 7221(b)(2) and (b)(3).

These significant decisions are not in § 7221(b)(2) or (b)(3): "promotion", "demotion, suspension, and termination", "educational credentials", "suspension and expulsion", financial or lending services, housing, and healthcare services. For these decisions, the business must give the opt-out, unless the conditions of the human appeal exception apply.

Modulos reads the exceptions in § 7221(b)(2) and (b)(3) as applicable to each use (MRF-491, "Key concepts"). In this view, the exception does not apply to a different use of the same ADMT unless that use complies with its limits on significant decisions and its "solely" purpose condition.

The human appeal exception ​

Section 7221(b)(1) and (b)(1)(A) of the CCPA regulations give the human appeal exception and the conditions for the human reviewer:

The business provides the consumer with a method to appeal the decision to a human reviewer who has the authority to overturn the decision. To qualify for this exception, the business must do the following: (A) Designate a human reviewer to review and analyze the output of the ADMT and any other information that is relevant to change the significant decision at issue. This human reviewer must consider the information provided by the consumer in support of their appeal and may consider any other sources of information about the significant decision. The human reviewer must know how to interpret and use the output of the ADMT that made the significant decision being appealed and must have the authority to change the decision based on their analysis.

Section 7221(b)(1)(B) gives the conditions for the method of appeal:

Clearly describe to the consumer how to submit an appeal and enable the consumer to provide information to the human reviewer in support of their appeal. The method of appeal must be easy for the consumers to execute, require minimal steps, and comply with section 7004. Disclosures and communications with consumers concerning the appeal must comply with section 7003, subsections (a)–(b). The timeline for requests to appeal ADMT must comply with section 7021. Businesses must comply with the verification requirements set forth in Article 5 when a consumer submits an appeal.

The conditions apply to the human reviewer and to the method of appeal. They do not set a result for an appeal. If the business sends appeals to a person who does not have the authority to change the decision, the exception does not apply. The business must then give the opt-out, unless § 7221(b)(2) or (b)(3) applies to that use.

The human appeal exception is an exception to the opt-out (§ 7221(b)(1)). Section 7001(e)(1) gives the conditions for human involvement. For those conditions and how Modulos reads them, see ADMT and human involvement.

Verification of appeals. Section 7221(b)(1)(B) applies the verification requirements of Article 5 to appeals. The verification levels in § 7062(b)–(d) are for other types of request. They do not name a request to appeal ADMT. Section 7062(a) applies to each consumer who "does not have or cannot access a password-protected account", "in addition to section 7060". For the general rules of § 7060, see Access to ADMT.

The exceptions in section 7221(b)(2) and (b)(3) ​

Section 7221(b)(2) and (b)(3) of the CCPA regulations give two exceptions with the same structure. The first exception is for "admission, acceptance, or hiring decisions":

For admission, acceptance, or hiring decisions as set forth in section 7001, subsections (ddd)(3)(A) and (ddd)(4)(A), if the following are true: (A) The business uses the ADMT solely for the business’s assessment of the consumer’s ability to perform at work or in an educational program to determine whether to admit, accept, or hire them; and (B) The ADMT works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.

The other exception is for "allocation/assignment of work and compensation decisions":

For allocation/assignment of work and compensation decisions as set forth in section 7001, subsection (ddd)(4)(B), if the following are true: (A) The business uses the ADMT solely for the business’s allocation/assignment of work or compensation; and (B) The ADMT works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.

These points apply to the two exceptions:

  • Condition (A) limits the purpose. The condition "solely" limits the purpose for which the business uses the ADMT. Each exception has a different "solely" purpose condition (§ 7221(b)(2)(A), (b)(3)(A)).
  • Condition (B) is a condition on the result. The ADMT must work for the purpose of the business, and it must not "unlawfully discriminate based upon protected characteristics". The regulations do not give a test, an audit, a type of record, or an interval to show this condition. In its Final Statement of Reasons, the Agency tells businesses that this condition replaced two requirements from its "proposed regulations" during rulemaking. These were to examine the ADMT, and to have policies, procedures, and training for the same result.
  • The Pre-use Notice names the exception. The Pre-use Notice must identify the exception that the business uses (§ 7220(c)(2)(B)).

The safeguards in § 7152(a)(6)(A), which a business "may consider" for its risk assessment report, are a different rule. They are not the conditions of these exceptions. See Contents of the risk assessment.

Modulos reads § 7001(cc), "performance at work", and § 7001(dd), "performance in an educational program", as limits on the assessment in § 7221(b)(2)(A) (MRF-493, "Key concepts"). In this view, an ADMT that makes an assessment of an item that these provisions do not include is not used "solely" for that assessment. Examples of such items are "union membership or interest in unionizing" and the "location when off-duty or on breaks". Section 7221(b)(2)(A) does not use these two terms. For the terms, see the decision test.

Access to ADMT ​

In § 7222(a) of the CCPA regulations, a business that uses ADMT to make a significant decision "must provide a consumer with information about this use when responding to a consumer’s request to access ADMT". Section 7222(b) gives four items. The business must give a "plain language explanation" of each item:

  1. Purpose. The "specific purpose for which the business used ADMT with respect to the consumer". The business must not give the purpose in "generic terms", for example "to improve our services".

  2. Logic. Section 7222(b)(2) gives this item:

    Information about the logic of the ADMT. Such information must enable a consumer to understand how the ADMT processed their personal information to generate an output with respect to them, which may include the parameters that generated the output as well as the specific output with respect to the consumer.

  3. Result. Section 7222(b)(3) gives this item:

    The outcome of the decisionmaking process for the consumer, including how the business used the output of the ADMT to make a significant decision with respect to the consumer.

    For example, the business can tell the consumer if the output was the "sole factor" used to make the decision. If it was not, the business can identify the "other factors" used to make the decision (§ 7222(b)(3)). A person can have a part in the decision without "human involvement" (§ 7001(e)(1)). The business can tell the consumer the function of that person. Section 7222(b)(3)(A) adds a condition:

    If the business also plans to use the output to make an additional significant decision concerning the consumer in the future, the business’s explanation must include how the business plans to use that output to make a significant decision about the consumer in the future.

  4. Rights. "That the business is prohibited from retaliating against consumers for exercising their CCPA rights, and instructions for how the consumer can exercise their other CCPA rights." The instructions "must include any links to an online request form or portal for making such a request, if offered by the business". The business "may comply with the instructions requirement by providing a link that takes the consumer directly to the specific section of the business’s privacy policy that contains these instructions" ((b)(4)(A)). A link to the start of the privacy policy, or to a section without the instructions, does not comply. The link applies only to the instructions, not to the non-retaliation part.

Limits for items (2) and (3) (§ 7222(c)). For items (2) and (3) only, § 7222(c) gives the same two limits as § 7220(d). These are trade secrets, and information that "would compromise the business’s ability to" do one of the three tasks in § 7220(d)(2). See Pre-use Notice. These limits do not apply to items (1) and (4).

Methods, verification, and rejected requests (§ 7222(d)–(h)):

  • The methods "must be easy to use and must not use dark patterns". The business is permitted to use its methods for requests to know, delete, or correct (§ 7020) ((d)).
  • The business must comply with the verification requirements of Article 5. "If a business cannot verify the identity of the person making the request to access ADMT, the business must inform the requestor that it cannot verify their identity." ((e))
  • If the business rejects a verified request, fully or in part, because of "a conflict with federal or state law, or an exception to the CCPA", it "must inform the requestor and explain the basis for the denial, unless prohibited from doing so by law". If it rejects the request "only in part", it "must disclose the other information sought by the consumer" ((f)).
  • The business "must use reasonable security measures when transmitting the requested information to the consumer" ((g)).
  • A business that "maintains a password-protected account with the consumer" is permitted to use "a secure self-service portal". The "secure self-service portal" must let consumers "access, view, and receive a portable copy of their requested information" (§ 7222(h)). These conditions of § 7222(h) apply to it: it "fully discloses the requested information that the consumer is entitled to under the CCPA and these regulations, uses reasonable data security controls, and complies with the verification requirements set forth in Article 5".

Levels of verification. Article 5 of the CCPA regulations gives these rules for verification:

  • Section 7060 applies to all requests to access ADMT:
    • The business "shall establish, document, and comply with a reasonable method for verifying" the person ((a)).
    • The business must "Match the identifying information provided by the consumer to the personal information of the consumer already maintained by the business before requesting additional information, or use a third-party identity verification service that complies with this section" ((c)(1)).
    • The business must "Avoid collecting the types of personal information identified in Civil Code section 1798.81.5, subdivision (d), unless necessary for the purpose of verifying the consumer" ((c)(2)).
    • The business must "Consider the following factors" of § 7060(c)(3) when it selects its method of verification.
    • The business "shall avoid requesting additional information from the consumer for purposes of verification" ((d)). If it cannot verify the consumer from the information that it keeps, it "may request additional information from the consumer". It must use that information only for the purposes in § 7060(d): "verifying the identity of the consumer seeking to exercise their rights under the CCPA, security, or fraud-prevention". It must delete that information "as soon as practical after processing the consumer’s request, except as required to comply with section 7101" ((d)).
    • The business must use "reasonable security measures" to find verification requests that are fraudulent. The measures must also prevent the "unauthorized deletion, correction, or access to a consumer’s personal information". They must prevent "unauthorized" access to information about the business’s use of ADMT for a consumer (§ 7060(f)).
  • If the business has a password-protected account with the consumer, it is permitted to verify the consumer through its "existing authentication practices" for the account. The business must also comply with § 7060. Before it discloses the data of the consumer, it must make the consumer "reauthenticate themselves" (§ 7061(a)).
  • If the consumer "does not have or cannot access a password-protected account", § 7062 applies together with § 7060. The business must verify the consumer to a "reasonably high degree of certainty" (§ 7062(c)). This "may include matching at least three pieces of personal information provided by the consumer with personal information maintained by the business that it has determined to be reliable for the purpose of verifying the consumer together with a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request". If the business uses this method, it "shall maintain all signed declarations as part of its recordkeeping obligations".
  • If the business cannot verify the requestor, it "shall deny" the request to access ADMT (§ 7062(f)).
  • If the business has "no reasonable method" to verify the consumer "to the degree of certainty required by this section", it "shall state so in response to any request and explain why" (§ 7062(g)). If it can verify no consumer, it "shall explain why it has no reasonable verification method in its privacy policy". It also "shall evaluate and document whether a reasonable method can be established at least once every 12 months, in connection with the requirement to update the privacy policy set forth in Civil Code section 1798.130, subdivision (a)(5)".

Aggregate-level response (§ 7222(j)). Section 7222(j) gives this alternative:

A business that used an ADMT with respect to a consumer more than four times within a 12-month period may provide an aggregate-level response to the consumer’s request to access ADMT. Specifically, for the information required by subsection (b)(2), the business may provide a summary of the outputs with respect to the consumer over the preceding 12 months; the parameters that, on average over the preceding 12 months, affected the outputs with respect to the consumer; and a summary of how those parameters applied to the consumer.

Section 7222(j) gives the aggregate-level response only for the logic in item (2). The business is permitted to give more information (§ 7222(l)). Examples are "the range of possible outputs", and "the five most common outputs of the ADMT and the percentage of consumers that received each of those outputs during the preceding calendar year".

Limits that apply and limits that do not. Two limits in other provisions do not name requests to access ADMT:

  • In Civil Code § 1798.130(b), a business "is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period".
  • Section 7060(e), the rule against a fee for verification, names only requests to delete, correct, and know.

These limits apply to requests to access ADMT:

  • The rule of § 7222(d) on methods (see above).
  • The business "shall not add unnecessary burden or friction to the process by which the consumer submits a CCPA request" (§ 7004(a)(5)).
  • The business can charge a fee, or "refuse to act on the request", only if the requests are "manifestly unfounded or excessive". See Time limits for requests.

Other duties. A service provider or contractor must help the business with its "response" to a verifiable consumer request to access ADMT (§ 7222(i)). See the duties of service providers and contractors. The business "must not retaliate against a consumer because the consumer exercised their right to access ADMT" (§ 7222(k)).

Non-retaliation and non-discrimination ​

Civil Code § 1798.125(a)(1) tells a business that it "shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under this title". Section 7221(l) and § 7222(k) of the CCPA regulations apply this rule to the opt-out of ADMT and to access to ADMT. Section 7080 of the regulations gives these rules:

  • "A price or service difference is discriminatory, and therefore prohibited by Civil Code section 1798.125, if the business treats a consumer differently because the consumer exercised a right conferred by the CCPA or these regulations." ((a))
  • A business is permitted to give a price or service difference that is non-discriminatory. A price or service difference is non-discriminatory "if it is reasonably related to the value of the consumer’s data". If the business cannot calculate a "good-faith estimate" of that value, or cannot show that relation, it "shall not offer the price or service difference" ((b)).
  • A business can reject a request to access ADMT or a request to opt-out of ADMT "for reasons permitted by the CCPA or these regulations". When it rejects such a request, this "shall not be considered discriminatory". The same rule applies to requests to delete, correct, or know, and to requests to opt-out of sale or sharing ((c)).
  • The business "shall notify consumers of any financial incentive or price or service difference subject to Civil Code section 1798.125 that it offers in accordance with section 7016" ((e)).
  • "A price or service difference that is the direct result of compliance with a state or federal law shall not be considered discriminatory." ((g))

The statute also includes "Retaliating against an employee, applicant for employment, or independent contractor" in this rule (Civil Code § 1798.125(a)(1)(E)). The Pre-use Notice and the "response" to a request to access ADMT must tell the consumer about this rule (§ 7220(c)(4), § 7222(b)(4)).

Time limits for requests ​

Section 7021 of the CCPA regulations gives the business time limits to "respond" to requests to access ADMT and requests to appeal ADMT. The same limits apply to requests to delete, correct, and know.

10 business days (§ 7021(a)). Not after 10 business days from the date it receives the request, the business must "confirm receipt". It must also give information about how it will process the request. The information must "describe in general the business’s verification process and when the consumer should expect a response". The exception "in instances where the business has already granted or denied the request" applies only to that information. The business must also "confirm receipt" in those conditions.

45 calendar days (§ 7021(b)). Section 7021(b) gives the time limit for the "response":

Businesses shall respond to a request to delete, request to correct, request to know, request to access ADMT, and request to appeal ADMT no later than 45 calendar days after receipt of the request. The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request. If the business cannot verify the consumer within the 45-day time period, the business may deny the request. If necessary, businesses may take up to an additional 45 calendar days to respond to the consumer’s request, for a maximum total of 90 calendar days from the day the request is received, provided that the business provides the consumer with notice and an explanation of the reason that the business will take more than 45 days to respond to the request.

Rules of the CCPA (Civil Code § 1798.145(h)). The statute adds three rules for verifiable consumer requests:

(1) A time period for a business to respond to a consumer for any verifiable consumer request may be extended by up to a total of 90 days where necessary, taking into account the complexity and number of the requests. The business shall inform the consumer of any such extension within 45 days of receipt of the request, together with the reasons for the delay. (2) If the business does not take action on the request of the consumer, the business shall inform the consumer, without delay and at the latest within the time period permitted of response by this section, of the reasons for not taking action and any rights the consumer may have to appeal the decision to the business. (3) If requests from a consumer are manifestly unfounded or excessive, in particular because of their repetitive character, a business may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request and notify the consumer of the reason for refusing the request. The business shall bear the burden of demonstrating that any verifiable consumer request is manifestly unfounded or excessive.

Requests to opt-out of ADMT. Section 7021 does not name requests to opt-out of ADMT. Their time limits are in § 7221(m)–(n). See Opt-out of ADMT.

The business and requests from consumers ​

The CCPA regulations give a business that receives CCPA requests, and also requests about ADMT, these other duties:

  • Methods (§ 7004). Section 7004(a) gives five rules for methods to submit CCPA requests. They are "Easy to understand", "Symmetry in choice", no "language or interactive elements that are confusing to the consumer", no "choice architecture that impairs or interferes with the consumer’s ability to make a choice", and "Easy to execute". Methods "must be tested to ensure that they are functional and do not undermine the consumer’s choice to submit the request" (§ 7004(a)(5)). A method that does not comply with § 7004(a) "may be a dark pattern" (§ 7004(b)).
  • Who can make a request. Civil Code § 1798.140(ak) gives the conditions for a verifiable consumer request. It is "a request that is made by a consumer, by a consumer on behalf of the consumer’s minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, or by a person who has power of attorney or is acting as a conservator for the consumer". The business must also be able to verify it. Section 7063 gives the rules for an authorized agent for requests to delete, correct, or know. Section 7221(j) gives the rules for requests to opt-out of ADMT.
  • Information for personnel (§ 7100(a)). "All individuals responsible for handling consumer inquiries about the business’s information practices or the business’s compliance with the CCPA shall be informed of all of the requirements in the CCPA and these regulations and how to direct consumers to exercise their rights under the CCPA and these regulations."
  • Records (§ 7101). The business "shall maintain records of consumer requests made pursuant to the CCPA and how it responded to the requests for at least 24 months". It must use "reasonable security procedures and practices" for these records. It must not use the records for other purposes, "except as reasonably necessary for the business to review and modify its processes for compliance with the CCPA and these regulations". It must not disclose them to a third party, "except as necessary to comply with a legal obligation".
  • Privacy policy (§ 7011(e)). The privacy policy of a business to which § 7200(a) applies must tell consumers about the right to access ADMT ((e)(2)(G)). Unless § 7221(b) applies, it must also tell them about the right to opt out of ADMT ((e)(2)(F)). It must also give "A general description of the process the business uses to verify a consumer request to know, request to delete, request to correct, and request to access ADMT" ((e)(3)(E)).

Two more duties apply only at 10,000,000 or more consumers in a calendar year. The tests for the two duties are not the same:

  • Training policy (§ 7100(b)). Section 7100(b) gives the test and the duty:

    A business that knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year shall establish, document, and comply with a training policy to ensure that all individuals responsible for handling consumer requests made under the CCPA or the business’s compliance with the CCPA are informed of all the requirements in these regulations and the CCPA.

  • Metrics (§ 7102). Section 7102(a) applies to a business that "knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells, shares, or otherwise makes available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year". For the previous calendar year, the business must "Compile the following metrics" ((a)(1)). These include the number of requests to access ADMT and of requests to opt-out of ADMT that it "received, complied with in whole or in part, and denied" ((a)(1)(D), (G)). It must disclose the metrics "by July 1 of every calendar year" in its privacy policy, or on its website through a link in its privacy policy ((a)(2)).

The Article 11 duties side by side ​

A business that uses ADMT for a significant decision must comply with these Article 11 duties on the dates in § 7200(b). For use before January 1, 2027, the business must comply "no later than January 1, 2027". For use on or after that date, compliance is necessary at each time of use (§ 7200(b)).

ItemDuty of the businessProvision and full conditions
Pre-use NoticeGive information about the ADMT use and consumer rightsSection 7220
Opt-outLet consumers opt out unless a § 7221(b) exception applies on its conditionsSection 7221
AccessGive information about the ADMT use on request, with verification and the applicable exceptionsSection 7222

Article 11 in Modulos ​

The CCPA ADMT Regulations Frameworks in Modulos hold these Article 11 Requirements: MRF-490 to MRF-494 in MFF-29 (AI System level), and ORF-488 and ORF-489 in OFF-29 (Organization level).

For the provisions of each Requirement, see The Requirements. For the sequence of work, see Steps that Modulos recommends.

Where to go next ​

Disclaimer

This page gives general information. It is not legal advice. Article 11 applies on the dates in § 7200(b).