California CCPA ADMT Regulations

Jurisdiction:: California

phased enforcement

Effective:: Jan 1, 2026

Authority:: California Privacy Protection Agency

Official text Verified May 21, 2026

Obligations Covered

Transparency & Disclosure Explainability Risk Assessment

Timeline

Milestone	Date	Notes
CPPA Board adopted	Jul 24, 2025	Board adopted final regulations
OAL approval and filing	Sep 22, 2025	Approved by OAL and filed with Secretary of State
Regulations effective	Jan 1, 2026	Includes Article 10 risk assessment requirements; later compliance dates apply to specified duties
ADMT obligations	Jan 1, 2027	Consumer rights enforceable
Risk assessment requirements begin	Jan 1, 2026	Assessment before initiating covered processing; covered activities initiated before 2026 and continuing afterward assessed by 2027-12-31 (§ 7155)
First CPPA submission	Apr 1, 2028	Attestation for assessments conducted 2026–2027

Related Regulations and Standards

Related instruments are selected from shared compliance obligations and jurisdiction coverage.

Provisions (2)

Consumer Transparency for ADMT

Obligation:: Transparency

enacted

Effective:: Jan 1, 2027

Risk tier:: all

Scope:: Businesses using ADMT to make a **significant decision** concerning a consumer. "Significant decision" means one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (11 CCR § 7001(ddd)). Each domain is defined in turn: housing excludes decisions based solely on availability, vacancy, or receipt of payment (§ 7001(ddd)(2)); education covers admission, credentials, and suspension or expulsion (§ 7001(ddd)(3)); employment covers hiring, work allocation and compensation, promotion, and demotion, suspension or termination (§ 7001(ddd)(4)). Advertising to a consumer is expressly not a significant decision (§ 7001(ddd)(6))

Requirements

Requirement	Details
Pre-use notice	Conspicuous notice before ADMT use describing purpose, how it works, outputs, and available consumer rights (§ 7220)
Opt-out right	Consumers may opt out of ADMT used to make significant decisions, subject to the exceptions in § 7221(b). A business that interacts with consumers online and provides an opt-out must include an opt-out link in the Pre-use Notice (§ 7221(a)-(c))
Access right	Consumers may request information about the business's use of ADMT with respect to them (§ 7222)
Human appeal exception	A business may use the § 7221(b)(1) exception to the opt-out duty if it provides a qualifying method to appeal the significant decision to a human reviewer with authority to overturn it; the Pre-use Notice must then explain how to appeal (§§ 7220(c)(2)(A), 7221(b)(1))
No retaliation	Business may not retaliate against consumer for exercising ADMT rights

Penalties

Violation	Fine
Per violation	Up to $2,663 per violation; $7,988 for intentional violations or violations involving personal information known to concern consumers under 16 (CPI adjustment effective January 1, 2025)

Sources: CPPA Regulations Approved regulations snapshot Official final rulemaking status CPPA CPI adjustment snapshot

ADMT Risk Assessment

Obligation:: Risk Assessment

enforcing

Effective:: Jan 1, 2026

Risk tier:: high-risk

Scope:: Businesses using ADMT to make a **significant decision** concerning a consumer. "Significant decision" means one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (11 CCR § 7001(ddd)). Each domain is defined in turn: housing excludes decisions based solely on availability, vacancy, or receipt of payment (§ 7001(ddd)(2)); education covers admission, credentials, and suspension or expulsion (§ 7001(ddd)(3)); employment covers hiring, work allocation and compensation, promotion, and demotion, suspension or termination (§ 7001(ddd)(4)). Advertising to a consumer is expressly not a significant decision (§ 7001(ddd)(6))

Requirements

Requirement	Details
Pre-processing assessment	Risk assessment required before initiating covered processing, including ADMT for significant decisions (§ 7155(a)(1), referring to § 7150(b)); contents governed by § 7152
Assessment review and approval	Document the assessment review/approval date and reviewers; an individual authorized to participate in deciding whether processing begins must review and approve the assessment (§ 7152(a)(9)); legal counsel providing legal advice need not be named
Triennial review	Review at least every 3 years and update as necessary; material-change updates as soon as feasibly possible and no later than 45 calendar days (§ 7155(a)(2)-(3))
Retention	Retain original and updated assessments while processing continues or for 5 years after completion of the risk assessment, whichever is later (§ 7155(c))
Submission to CPPA	Risk assessment information, including attestation, submitted to CPPA by April 1, 2028 for 2026-2027 assessments; after 2027, by April 1 following each assessment year (§ 7157(a)-(b)). Assessment reports must separately be produced to CPPA or the Attorney General within 30 calendar days of a request (§ 7157(e))
Pre-2026 activities	Covered processing initiated before January 1, 2026 and continuing after that date must be assessed by December 31, 2027 (§ 7155(b))

Penalties

Violation	Fine
Per violation	Up to $2,663 per violation; $7,988 for intentional violations or violations involving personal information known to concern consumers under 16 (CPI adjustment effective January 1, 2025)

Sources: CPPA Regulations Approved regulations snapshot Official final rulemaking status CPPA CPI adjustment snapshot

Cite this regulation

Permalink: https://everyailaw.com/regulation/california-ccpa-admt/

JSON: https://everyailaw.com/api/v1/regulations.json

Attribution: EveryAILaw, PAICE.work PBC. “California CCPA ADMT Regulations”, EveryAILaw.com, May 21, 2026. https://everyailaw.com/regulation/california-ccpa-admt/

Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.