Appearance
Pre-use Notice, opt-out, and access
Where a business uses ADMT to make a significant decision concerning a consumer, Article 11 runs as one sequence for the consumer: a Pre-use Notice at or before the point when the business collects the personal information it plans to process using the ADMT, or, for information already collected for a different purpose, before that processing (§ 7220); the ability to opt out of that use, unless one of three exceptions applies on its conditions (§ 7221); and, on request, access to ADMT, meaning plain-language explanations of the specific purpose, the logic, and the outcome, plus the non-retaliation statement with instructions for the consumer's other CCPA rights (§ 7222). MFF-29 carries these as MRF-490 through MRF-494, all tagged CCPA Role: Business using ADMT. The organization framework supplies the request machinery they run on (ORF-488) and the reviewer capability behind a human-involvement or human-appeal claim (ORF-489).
Timing
The Article 11 duties run on the § 7200(b) branches: a business that used ADMT for a significant decision before January 1, 2027 must be in compliance no later than January 1, 2027; a business that uses ADMT on or after that date must be in compliance any time it is using ADMT for a significant decision. Relying on an exception to the opt-out does not narrow the other duties: the Pre-use Notice, the right to access ADMT, non-retaliation, and the risk assessment all stand.
Pre-use Notice — MRF-490
A business that uses ADMT as set forth in § 7200(a) must provide consumers with a Pre-use Notice informing them about the use and about their rights to opt out of ADMT and to access ADMT (§ 7220(a)). It may sit inside the Notice at Collection, provided that notice complies with, and includes the information required by, § 7220(b) and (c).
Timing and placement (§ 7220(b)(2)), verbatim:
Be presented prominently and conspicuously to the consumer at or before the point when the business collects the consumer’s personal information that the business plans to process using ADMT.
Two timing branches: information collected for the ADMT purpose is on the collection-time branch quoted above; where the business already collected it for a different purpose and later plans to process it using ADMT for a significant decision, the notice must come before that processing. Prominence and conspicuousness are conditions in their own right. The notice must comply with § 7003(a)–(b) ((b)(1)) and be presented in the manner in which the business primarily interacts with the consumer ((b)(3)).
Content (§ 7220(c)):
| Element | Content |
|---|---|
| (1) Specific purpose | "A plain language explanation of the specific purpose for which the business plans to use the ADMT." Generic terms, such as "to make a significant decision" without further information, do not describe the specific decision |
| (2) Opt-out, or its substitute | A description of the right to opt out of ADMT and how to submit the request, unless the business is not required to provide the opt-out because it relies on a § 7221(b) exception; then the substitution below |
| (3) Access | The right to access ADMT and how to submit that request |
| (4) Non-retaliation | That the business is prohibited from retaliating against consumers for exercising their CCPA rights |
| (5) How the ADMT works | How the ADMT processes personal information to make a significant decision, including the categories of personal information that affect the output ((A)); the type of output and how it is used to make a significant decision ((B)); and the alternative process for consumers who opt out, unless a § 7221(b) exception applies ((C)). This layer may be delivered by a simple and easy-to-use method, for example a layered notice or a hyperlink, but its content is mandatory |
The two substitutions (§ 7220(c)(2)(A)–(B)), verbatim:
If the business is not required to provide the ability to opt-out because it is relying upon the human appeal exception set forth in section 7221, subsection (b)(1), the business must instead inform the consumer of their ability to appeal the decision and provide instructions to the consumer on how to submit their appeal. … If the business is not required to provide the ability to opt-out because it is relying upon another exception set forth in section 7221, subsection (b), the business must identify the specific exception it is relying upon.
Relying on an exception while still offering a genuine opt-out is not a breach; where the exception replaces the opt-out, the substitution is mandatory. An exception changes what the opt-out paragraph says; it never removes the notice.
The carve-outs are narrow (§ 7220(d)): in the (c)(5) information only, the notice need not include trade secrets as defined in Civ. Code § 3426.1(d), or information that would compromise the business's ability to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; to resist malicious, deceptive, fraudulent, or illegal actions directed at the business or at consumers, or to prosecute those responsible for those actions; or to ensure the physical safety of natural persons. Each limb is activity-specific: the test is compromise of that ability, not that the material is security-, fraud-, or safety-related. Nothing may be left out of the purpose, the rights paragraphs, or the non-retaliation statement.
Consolidation is optional (§ 7220(e)): one notice may cover a single ADMT for multiple purposes, multiple ADMTs for a single purpose, multiple ADMTs for multiple purposes, or the systematic use of a single ADMT, provided that it includes the information Article 11 requires for each of the business's proposed uses.
Disclosure quality (§ 7003(a)–(b)) applies because the Pre-use Notice is an Article 2 disclosure (§ 7010(c)): plain, straightforward language without technical or legal jargon; a format that makes the disclosure readable, including on smaller screens, if applicable; the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements and other information to consumers in California; and reasonable accessibility to consumers with disabilities, which for notices provided online means following generally recognized industry standards such as WCAG 2.1 (the example, not the exclusive route) and in other contexts means providing information on how a consumer with a disability may access the policy in an alternative format. The privacy policy must state the right to opt out of ADMT (except as set forth in § 7221(b)) and, with no corresponding exception, the right to access ADMT (§ 7011(e)(2)(F)–(G)), and § 7010(d) requires, except as set forth in § 7221(b), an opt-out link in the Pre-use Notice.
The Requirement is carried by the new Control MCF-696 (Pre-use Notice): timing, prominence and conspicuousness, channel, content, and quality, including language coverage. It is conditional on the ADMT being used for a significant decision; it is not applicable where MRF-489 concludes that the technology is not ADMT, that the decision is not significant, or that the business does not use it for that purpose.
Opt-out of ADMT — MRF-491
A business must provide consumers with the ability to opt-out of the use of ADMT to make a significant decision concerning the consumer, except as set forth in subsection (b).
Methods (§ 7221(c)): two or more designated methods, chosen considering how the business interacts with consumers, how it uses the ADMT, and ease of use, at least one reflecting the manner in which the business primarily interacts with the consumer. Online, verbatim:
A business that interacts with consumers online must, at a minimum, allow consumers to submit requests to opt-out through an interactive form accessible via an opt-out link that is provided in the Pre-use Notice. The link title must state what the consumer is opting out of, such as “Opt-out of Automated Decisionmaking Technology.”
Other methods include a toll-free phone number, a designated email address, a form submitted in person, and a form submitted through the mail. A notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method, because cookies concern the collection of personal information and not necessarily the use of ADMT; an acceptable method must be specific to the right to opt out of the business's use of the ADMT (§ 7221(c)(4)). An ADMT-specific option inside a broader consent tool can be one of the designated methods.
The mechanics (§ 7221(d)–(n)):
| Rule | Content |
|---|---|
| Quality and burden ((d)–(e)) | Methods easy to execute, requiring minimal steps, and compliant with § 7004; no account and no information beyond what is necessary to direct the business to opt the consumer out |
| No verification ((f); § 7060(b)) | The business must not require a verifiable consumer request or require the consumer to verify their identity; it may ask for information necessary to complete the request, such as what is needed to identify the consumer subject to the use, provided it is not burdensome (the regulation's illustration: a name may be asked for, a photograph with a driver's license may not) |
| Fraud ((g)) | A fraud-based denial requires a good-faith, reasonable, and documented belief that the request is fraudulent, with notice to the requestor that the business will not comply and an explanation of why it believes the request is fraudulent; denials for other reasons the CCPA or the regulations permit are governed by those provisions |
| Confirmation and granular choice ((h)–(i)) | A means for the consumer to confirm the request was processed; a choice to allow specific uses may be presented only alongside a single option to opt out of all the business's uses of ADMT for significant decisions |
| Agents ((j)) | An authorized agent with written permission signed by the consumer; the business may deny an agent request where that signed permission is not provided |
| Waiting period and non-retaliation ((k)–(l)) | Except as allowed by the regulations, at least 12 months from receipt of the request before asking the consumer to consent to the use of the ADMT they opted out of; no retaliation (Civ. Code § 1798.125; Article 7) |
| Pre-initiation request ((m)) | A request arriving before the business initiates the processing bars it from initiating processing of that consumer's personal information using that ADMT |
| Post-initiation request ((n)) | Where the consumer did not opt out in response to the Pre-use Notice and submits the request after the processing began, the business must cease and notify |
The cessation clock (§ 7221(n)(1)), verbatim:
Ceasing to process the consumer’s personal information using that ADMT as soon as feasibly possible, but no later than 15 business days from the date the business receives the request
and the business must notify all its service providers, contractors, or other persons to whom it has disclosed or made personal information available to process that consumer's personal information using that ADMT that the consumer has made the request, instructing them to comply within the same time frame ((n)(2)). The command runs to the business; what recipients owe rests on their contracts, carried by MRF-496.
Denials and non-discrimination (§ 7080): a denial for reasons permitted by the CCPA or the regulations is not discriminatory (§ 7080(c)); a price or service difference is discriminatory where the business treats a consumer differently because they exercised a right, is non-discriminatory where it is reasonably related to the value of the consumer's data, and is not considered discriminatory where it is the direct result of compliance with a state or federal law (§ 7080(a)–(b), (g)); the statute expressly covers retaliating against an employee, applicant for employment, or independent contractor (Civ. Code § 1798.125(a)(1)(E)).
The Requirement is carried by the new Control MCF-697 (ADMT opt-out mechanics). It is conditional twice over: it applies only where the ADMT is used for a significant decision, and only where no § 7221(b) exception is relied on; where one is, MRF-492 or MRF-493 carries the conclusion. An exception relied on for one use does not excuse the opt-out for a different use of the same ADMT.
The three exceptions, on their conditions
§ 7221(b) lists three circumstances in which a business is not required to provide the ability to opt out. Each is conditional, each removes only the opt-out, and each changes what the Pre-use Notice says.
| Exception | Reaches | Conditions | Requirement |
|---|---|---|---|
| (b)(1) Human appeal | Any significant decision | A method to appeal to a human reviewer with the authority to overturn the decision; the five reviewer conditions; the clearly described, easy, minimal-step, § 7004-compliant method with a channel for the consumer's information; § 7003(a)–(b) communications; § 7021 timelines; Article 5 verification | MRF-492 |
| (b)(2) Admission, acceptance, or hiring | Admission or acceptance into academic or vocational programs, and hiring (§ 7001(ddd)(3)(A), (ddd)(4)(A)) only | The ADMT is used solely for the business's assessment of the consumer's ability to perform at work or in an educational program to determine whether to admit, accept, or hire them; and the ADMT works for the business's purpose and does not unlawfully discriminate based upon protected characteristics | MRF-493 |
| (b)(3) Allocation/assignment of work and compensation | Allocation or assignment of work for employees, and salary, hourly or per-assignment compensation, incentive compensation such as a bonus, or another benefit (§ 7001(ddd)(4)(B)) only | The ADMT is used solely for the business's allocation/assignment of work or compensation; and the ADMT works for the business's purpose and does not unlawfully discriminate based upon protected characteristics | MRF-493 |
Neither (b)(2) nor (b)(3) reaches promotion, demotion, suspension or termination; educational credentials, suspension or expulsion; financial or lending services; housing; or healthcare services. For those decisions the business offers the opt-out or qualifies for the human-appeal exception.
Human-appeal route — MRF-492
The exception and its reviewer conditions (§ 7221(b)(1) and (b)(1)(A)), verbatim:
The business provides the consumer with a method to appeal the decision to a human reviewer who has the authority to overturn the decision. To qualify for this exception, the business must do the following: (A) Designate a human reviewer to review and analyze the output of the ADMT and any other information that is relevant to change the significant decision at issue. This human reviewer must consider the information provided by the consumer in support of their appeal and may consider any other sources of information about the significant decision. The human reviewer must know how to interpret and use the output of the ADMT that made the significant decision being appealed and must have the authority to change the decision based on their analysis.
The method and the machinery it imports (§ 7221(b)(1)(B)), verbatim:
Clearly describe to the consumer how to submit an appeal and enable the consumer to provide information to the human reviewer in support of their appeal. The method of appeal must be easy for the consumers to execute, require minimal steps, and comply with section 7004. Disclosures and communications with consumers concerning the appeal must comply with section 7003, subsections (a)–(b). The timeline for requests to appeal ADMT must comply with section 7021. Businesses must comply with the verification requirements set forth in Article 5 when a consumer submits an appeal.
Five conditions bind the reviewer: designated for the review; reviews and analyzes the output and any other relevant information; considers the information the consumer provided in support of the appeal; knows how to interpret and use the output; and has the authority to change the decision. The conditions are about the reviewer and the method, not the outcome of any appeal. A route that sends appeals to someone who cannot change the decision, or who only re-runs the ADMT, does not qualify; the business then owes the opt-out unless (b)(2) or (b)(3) independently applies to that use.
The appeal is an exception to the opt-out, not a scoping argument. Human involvement under § 7001(e)(1) is tested in the original decision flow, so a reviewer available only after the decision never takes the technology out of the definition. The use stays in scope; the Pre-use Notice informs the consumer of the ability to appeal and how to submit the appeal, in place of the opt-out paragraph.
Verification: Article 5 applies to appeals, but its certainty tiers name requests to access ADMT and not appeals, so the § 7060 general rules govern: a reasonable method, established, documented, and complied with; matching the identifying information the consumer provides against the personal information the business already maintains before requesting additional information, or a compliant third-party identity-verification service; avoiding the Civ. Code § 1798.81.5(d) categories unless necessary to verify the consumer; the § 7060(c)(3) factors that set how stringent the verification should be; avoiding requests for additional information, which may be made only where the business cannot verify the consumer from the information it already maintains, used only for verification, security, or fraud prevention, and deleted as soon as practical after processing the request, except as § 7101 record-keeping requires; and reasonable security measures to detect fraudulent identity-verification activity and prevent unauthorized access to information about the business's use of ADMT with respect to a consumer (§ 7060(f)). Requests that are manifestly unfounded or excessive, in particular because of their repetitive character, may carry either a reasonable fee that takes into account the administrative costs of providing the information or communication or taking the requested action, or a refusal with notice of the reason; the business bears the burden of demonstrating that the request is manifestly unfounded or excessive (Civ. Code § 1798.145(h)(3)).
The Requirement is carried by the new Control MCF-698 (Human-appeal route). It is conditional on the business relying on the human-appeal exception in place of the opt-out for this ADMT; reliance is per use.
Hiring and work-allocation exceptions — MRF-493
The two exceptions, verbatim (§ 7221(b)(2) and (b)(3)):
For admission, acceptance, or hiring decisions as set forth in section 7001, subsections (ddd)(3)(A) and (ddd)(4)(A), if the following are true: (A) The business uses the ADMT solely for the business’s assessment of the consumer’s ability to perform at work or in an educational program to determine whether to admit, accept, or hire them; and (B) The ADMT works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.
For allocation/assignment of work and compensation decisions as set forth in section 7001, subsection (ddd)(4)(B), if the following are true: (A) The business uses the ADMT solely for the business’s allocation/assignment of work or compensation; and (B) The ADMT works for the business’s purpose and does not unlawfully discriminate based upon protected characteristics.
Three points decide whether an exception holds:
- "Solely" is a purpose limitation, not a statement about automation. It governs what the ADMT is used for. Carrying a hiring score into a later promotion, demotion, or termination decision, or using a work-allocation tool to screen applicants, puts that use outside the exception. A business may rely on an exception for one purpose and still owe the opt-out for another use of the same ADMT.
- The second condition is an outcome condition. "Works for the business's purpose and does not unlawfully discriminate based upon protected characteristics" is a fact about the technology; the exception is available only where that fact holds. The regulations prescribe no test, audit, documentation format, or review cadence for establishing it, and the Agency's Final Statement of Reasons explains that this flexible standard replaced the proposed duties to have evaluated the ADMT and to have implemented policies, procedures, and training to the same end. The business chooses how it shows the condition holds; the Agency's own examples, among the safeguards a business may consider in its risk assessment, are implementing policies, procedures, and training to ensure the ADMT works for the business's purpose and does not unlawfully discriminate (§ 7152(a)(6)(A)(iv)) and consulting external parties, such as those described in § 7151(b) (experts in detecting and mitigating bias in ADMT among them), to ensure the business maintains current knowledge of emergent privacy risks and countermeasures, and using that knowledge to identify, assess, and mitigate risks to consumers' privacy (§ 7152(a)(6)(A)(iii)).
- The assessment is bounded by the definitions of performance at work (§ 7001(cc)) and performance in an educational program (§ 7001(dd)) on the coverage page. An ADMT that scores an excluded matter, such as union membership or interest in unionizing, or off-duty location, is not used solely for such an assessment.
The Pre-use Notice must identify the specific exception relied upon (§ 7220(c)(2)(B)). The Requirement is carried by the new Control MCF-699 (Hiring and work-allocation exception evidence): whether the named exception is one the business qualifies for, the purpose limitation that keeps "solely" true, the outcome evidence relied on, and the match between the exception and the notice. It is conditional on § 7221(b)(2) or (b)(3) being relied on for this ADMT.
Access to ADMT — MRF-494
A business that uses ADMT for a significant decision must, when responding to a request to access ADMT, provide information about that use in four plain-language explanations (§ 7222(a)–(b)):
| Element | Content |
|---|---|
| (b)(1) Specific purpose | The specific purpose for which the business used ADMT with respect to that consumer, not in generic terms such as "to improve our services" |
| (b)(2) Logic | "Information about the logic of the ADMT. Such information must enable a consumer to understand how the ADMT processed their personal information to generate an output with respect to them, which may include the parameters that generated the output as well as the specific output with respect to the consumer." |
| (b)(3) Outcome | The outcome of the decisionmaking process for the consumer, including how the business used the output to make the significant decision; the Agency's examples are whether the output was the sole factor, which other factors played a role, and the role of any human who took part in a manner not meeting § 7001(e)(1). And, only where the business plans an additional significant decision from that output: "If the business also plans to use the output to make an additional significant decision concerning the consumer in the future, the business’s explanation must include how the business plans to use that output to make a significant decision about the consumer in the future." |
| (b)(4) Rights | The non-retaliation statement and instructions for exercising the consumer's other CCPA rights, including any links to an online request form or portal if the business offers them; a link taking the consumer directly to the privacy-policy section with those instructions satisfies it |
Carve-outs (§ 7222(c)) apply to the logic and outcome elements only: trade secrets as defined in Civ. Code § 3426.1(d), and information that would compromise the business's ability to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; to resist malicious, deceptive, fraudulent, or illegal actions directed at the business or at consumers, or to prosecute those responsible for those actions; or to ensure the physical safety of natural persons. The specific purpose and the rights instructions have no carve-out.
Methods, verification, and delivery (§ 7222(d)–(h)): methods easy to use and free of dark patterns, with the existing § 7020 request methods reusable; Article 5 verification, with an unverifiable requestor told so; a denial of a verified request, in whole or in part, because of a conflict with federal or state law or an exception to the CCPA explained to the requestor, unless prohibited by law, with a partial denial disclosing the other information sought; reasonable security in transmission; and, where the business maintains a password-protected account with the consumer, it may comply through a secure self-service portal for the consumer to access, view, and receive a portable copy of the requested information, if the portal fully discloses the requested information the consumer is entitled to, uses reasonable data security controls, and complies with the Article 5 verification requirements.
Verification tiers turn on the account. In every case the business establishes, documents, and complies with a reasonable verification method under § 7060, with its information-use limits and security requirements. Where the business maintains a password-protected account with the consumer, it may verify through its existing authentication practices for the account, provided that it follows § 7060, and must require re-authentication before disclosing the consumer's data (§ 7061(a)). Where the consumer does not have or cannot access such an account, § 7062 applies in addition to § 7060: verification to a reasonably high degree of certainty, which may include matching at least three pieces of personal information provided by the consumer with personal information the business maintains and has determined reliable, together with a signed declaration under penalty of perjury, all such declarations being maintained as part of the business's record-keeping (§ 7062(c)); a request to access ADMT that cannot be verified must be denied (§ 7062(f)); and where no reasonable method can verify the consumer to the required degree, the business states so in its response and explains why, explains in its privacy policy why it has no reasonable verification method where it can verify no consumer, and evaluates and documents at least once every 12 months, in connection with the Civ. Code § 1798.130(a)(5) privacy-policy update, whether a reasonable method can be established (§ 7062(g)).
The aggregate option (§ 7222(j)), verbatim:
A business that used an ADMT with respect to a consumer more than four times within a 12-month period may provide an aggregate-level response to the consumer’s request to access ADMT.
It is narrow: it covers only the logic information, as a summary of the outputs over the preceding 12 months, the parameters that on average affected them, and how they applied. Purpose, outcome and use, future use, and rights instructions stay individualized. Nothing prohibits the business from giving more information, for example the range of possible outputs or aggregate output statistics (§ 7222(l)).
What is not imported. The twice-in-12-months limit in Civ. Code § 1798.130(b) applies to the disclosures required by §§ 1798.110 and 1798.115, and the no-fee verification rule in § 7060(e) names requests to delete, correct, and know; neither extends to requests to access ADMT. A service provider or contractor must assist the business in responding to a verifiable consumer request to access ADMT (§ 7222(i); MRF-496). The business must not retaliate against a consumer for exercising the right (§ 7222(k)).
The Requirement is carried by the new Control MCF-700 (Access-to-ADMT response): completeness of the four explanations, the conditional future-use element, the carve-out boundary, method and verification quality, delivery, denial and no-action handling, and the clocks. It applies where the ADMT is used for a significant decision, whether or not an opt-out exception is relied on.
The request clocks — § 7021
Requests to access ADMT and requests to appeal ADMT run on the § 7021 timelines. The business confirms receipt no later than 10 business days after receiving the request, with information about how it will process it, which must describe in general the business's verification process and when the consumer should expect a response, except where the business has already granted or denied the request ((a)). The response, verbatim:
Businesses shall respond to a request to delete, request to correct, request to know, request to access ADMT, and request to appeal ADMT no later than 45 calendar days after receipt of the request. The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request.
Where the business cannot verify the consumer within that period it may deny the request; if necessary, taking into account the complexity and number of the requests, it may take up to 45 additional calendar days, for a maximum of 90 calendar days from receipt, provided it gives the consumer notice and an explanation of the reason within the first 45 days ((b); Civ. Code § 1798.145(h)(1)). A no-action response must state the reasons and any rights to appeal the decision to the business, without delay and at the latest within the permitted period (§ 1798.145(h)(2)). The § 7021 clocks do not name requests to opt out of ADMT, whose timing is the § 7221 mechanics above.
The organization capabilities — ORF-488 and ORF-489
ORF-488 (ADMT request-handling infrastructure) is the one intake, verification, clock, records, and reporting capability serving every ADMT the organization registers: § 7004 methods, tested to be functional and not to undermine the consumer's choice; the § 7021 clocks with the Civ. Code § 1798.145(h) no-action, extension, and manifestly-unfounded-or-excessive mechanics; Article 5 verification for access and appeals, never for an opt-out; authorized agents and the other submitters a verifiable consumer request admits (Civ. Code § 1798.140(ak)); all individuals responsible for handling consumer inquiries about the business's information practices or its CCPA compliance informed of the CCPA and regulatory requirements and of how to direct consumers to exercise their rights (§ 7100(a)); records of consumer requests and responses kept for at least 24 months under reasonable security, used for no other purpose except as reasonably necessary to review and modify the business's compliance processes, and shared with no third party except as necessary to comply with a legal obligation (§ 7101); and the § 7011(e) privacy-policy content. Two further duties turn on volume predicates that are not identical. A business that knows or reasonably should know that it, alone or in combination, buys, receives for its commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year must establish, document, and comply with a training policy for the individuals handling CCPA requests and compliance (§ 7100(b)). A business that knows or reasonably should know that it, alone or in combination, buys, receives for its commercial purposes, sells, shares, or otherwise makes available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year must compile, for the previous calendar year, the number of requests to access ADMT and requests to opt out of ADMT received, complied with in whole or in part, and denied, and disclose them by July 1 each year in its privacy policy or on its website through a link included in the privacy policy (§ 7102). Carried by the new Control OCF-385.
ORF-489 (Human involvement and human-appeal capability) has two limbs, both optional routes rather than freestanding duties. Where the organization relies on human involvement to keep a technology outside the ADMT definition, the reviewers in the original decision flow must know how to interpret and use the output, actually review and analyze it with the other relevant information, and have the authority to make or change the decision. Where it relies on the human-appeal exception in place of the opt-out, it must designate reviewers who meet § 7221(b)(1)(A), enable the consumer to provide information to them in support of the appeal, which they must consider, and answer on the § 7021 clocks. The two limbs answer different questions: the first decides whether Article 11 applies at all; the second presupposes that it applies and removes only the opt-out. An organization that relies on neither route, because it offers the opt-out or because (b)(2) or (b)(3) applies, owes neither capability and may mark the Requirement not applicable. Carried by the new Control OCF-386, which is scored against the route the organization states it relies on. The regulation conditions both routes on the reviewers' knowledge, review, and authority, not on any particular outcome; the reviewer roster, the training, the routing from intake to reviewer, and records of the reviewers' decisions, including any they changed, are the practice by which the organization shows that the route it chose actually holds.
The Article 11 duties side by side
Pre-use Notice (MRF-490) | Opt-out (MRF-491) | Access (MRF-494) | |
|---|---|---|---|
| Trigger | Use of ADMT for a significant decision | Use of ADMT for a significant decision, no § 7221(b) exception relied on | Use of ADMT for a significant decision, plus a request to access ADMT (the clocks run from receipt; verification gates the disclosure) |
| Timing | At or before collection of the personal information the ADMT will process; before processing for repurposed information | Pre-initiation request bars processing; post-initiation request from a consumer who did not opt out at the notice: cessation as soon as feasibly possible and no later than 15 business days from the date the business receives the request | Confirmation within 10 business days; response within 45 calendar days; where necessary, one extension of up to 45 further days with notice and an explanation within the first 45, never beyond 90 |
| Content | Specific purpose; opt-out or its substitute; access; non-retaliation; how the ADMT works | Two or more designated methods; for a business that interacts with consumers online, an interactive form via the notice link; no verification; confirmation; recipient instruction | Specific purpose; logic; outcome and use, and, where the business plans an additional significant decision from that output, how it will be used; rights instructions |
| Verification | — | Never required | Article 5: § 7060 in every case; § 7061 where the business maintains a password-protected account with the consumer; § 7062 in addition where the consumer does not have or cannot access such an account |
| Exceptions or carve-outs | § 7220(d) carve-outs on the (c)(5) layer only | Three § 7221(b) exceptions, each on its conditions | § 7222(c) carve-outs on logic and outcome only; aggregate option for the logic information where the ADMT was used with respect to that consumer more than four times in 12 months |
| Control | MCF-696 | MCF-697 where no exception is relied on; MCF-698 or MCF-699 carries the exception instead | MCF-700 |
Where to go next
- Coverage and roles — the determination these duties follow from.
- Service providers and ADMT suppliers — the recipient instruction on an opt-out and the duty to assist with access requests.
- Operationalizing the CCPA ADMT Regulations in Modulos — the full
MFF-29/OFF-29rollout.
Disclaimer
This page is for general informational purposes and does not constitute legal advice. The Article 11 duties run on the § 7200(b) timing branches, and the Agency has said it may revisit the ADMT provisions in future rulemaking. Always verify against the current published text and consult qualified advisers.