What are the key requirements of the CCPA ADMT rules?

Pre-use notice at or before collecting the personal information the ADMT will process, stating the specific purpose, how the ADMT works, and the opt-out and access rights Offer an opt-out through two or more methods, or rely on an exception: a human appeal with authority to overturn the decision, or ADMT used solely to assess ability to perform at work or to allocate work or pay, where it works for that purpose and does not unlawfully discriminate If an opt-out arrives after processing started, stop within 15 business days and tell service providers and contractors

US State·In Effect·Effective January 1, 2026

California CCPA Regulations on Automated Decisionmaking Technology (ADMT)

Q: When does the CCPA ADMT rules take effect?

The California CCPA Regulations on Automated Decisionmaking Technology (ADMT) took effect on January 1, 2026.

Dates and status re-checked against primary sources on October 16, 2026. How we verify

The California Privacy Protection Agency's updated CCPA regulations, approved by the Office of Administrative Law on September 22, 2025 and in effect since January 1, 2026, add rules for automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. A business that uses ADMT to make a significant decision about a consumer, such as hiring, work allocation, pay, promotion, demotion, suspension, termination or access to healthcare services, must give a pre-use notice, offer an opt-out or a permitted alternative, and answer access requests. Businesses already using ADMT for such decisions must comply by January 1, 2027.

What this means for your team

The rules only reach businesses covered by the CCPA, for example those with gross annual revenue of $26.625 million or more (the 2025 figure, adjusted for inflation every odd-numbered year) or that buy, sell or share the personal information of 100,000 or more California residents or households. Employees and job applicants count as consumers. If you are covered and a tool screens, ranks or scores people for these decisions without a reviewer who can change the outcome, the notice and opt-out must be ready by the compliance date.

Key requirements

Pre-use notice at or before collecting the personal information the ADMT will process, stating the specific purpose, how the ADMT works, and the opt-out and access rights
Offer an opt-out through two or more methods, or rely on an exception: a human appeal with authority to overturn the decision, or ADMT used solely to assess ability to perform at work or to allocate work or pay, where it works for that purpose and does not unlawfully discriminate
If an opt-out arrives after processing started, stop within 15 business days and tell service providers and contractors
Risk assessment before using ADMT for a significant decision; for processing that began before the rules took effect and continues, complete it by December 31, 2027
Submit risk assessment information for 2026 and 2027 to the CPPA by April 1, 2028, attested by a member of executive management

Penalties

Administrative fines of up to $2,663 per violation or $7,988 per intentional violation (2025 amounts; the next inflation adjustment is due January 1, 2027).

Key terms

CCPA Automated Decision-Making AI Risk Assessment Human Oversight

California CCPA Regulations on Automated Decisionmaking Technology (ADMT)

What this means for your team

Key requirements

Key terms

Further reading