California CCPA ADMT Regulations

Jurisdiction:

California

enacted

Effective:

Jan 1, 2027

Authority:

California Privacy Protection Agency

Official text Verified May 21, 2026

Obligations Covered

Transparency & Disclosure Explainability Risk Assessment

Timeline

Milestone	Date	Notes
Finalized	Sep 22, 2025	CPPA Board adopted
Regulations effective	Jan 1, 2026	Administrative provisions
ADMT obligations	Jan 1, 2027	Consumer rights enforceable
Risk assessments due	Jan 1, 2027	Mandatory before initiating new processing; pre-2026 activities by 2027-12-31
First CPPA submission	Apr 1, 2028	Attestation for assessments conducted 2026–2027

Related Regulations and Standards

Related instruments are selected from shared compliance obligations and jurisdiction coverage.

Provisions (2)

Consumer Transparency for ADMT #

Obligation:

Transparency

enacted

Effective:

Jan 1, 2027

Risk tier:

all

Scope:

Businesses using ADMT to make a **significant decision** concerning a consumer. "Significant decision" means one resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (11 CCR § 7001(ddd)). Each domain is defined in turn: housing excludes decisions based solely on availability, vacancy, or receipt of payment (§ 7001(ddd)(2)); education covers admission, credentials, and suspension or expulsion (§ 7001(ddd)(3)); employment covers hiring, work allocation and compensation, promotion, and demotion, suspension or termination (§ 7001(ddd)(4)). Advertising to a consumer is expressly not a significant decision (§ 7001(ddd)(6))

Requirements

Requirement	Details
Pre-use notice	Conspicuous notice before ADMT use describing purpose, how it works, outputs, and available consumer rights (§ 7220)
Opt-out right	Consumers may opt out of ADMT in significant decisions; opt-out link required in pre-use notice (§ 7221)
Access right	Consumers may request information about the business's use of ADMT with respect to them (§ 7222)
Appeal mechanism	Consumers may appeal ADMT-based decisions affecting them
No retaliation	Business may not retaliate against consumer for exercising ADMT rights

Penalties

Violation	Fine
Per violation	$2,500 standard; $7,500 intentional

Sources: CPPA Regulations

ADMT Risk Assessment #

Obligation:

Risk Assessment

enacted

Effective:

Jan 1, 2027

Risk tier:

high-risk

Scope:

Requirements

Requirement	Details
Pre-processing assessment	Risk assessment required before initiating high-risk processing including ADMT for significant decisions (§ 7150–7152)
Human oversight evaluation	Must evaluate adequacy of human oversight in risk assessment (§ 7152)
Triennial review	Review and update every 3 years, or within 45 days of a material change (§ 7155(a)(2)–(3))
Retention	Retain assessments for duration of processing or 5 years after completion, whichever is later (§ 7155(c))
Submission to CPPA	Attestation submitted to CPPA on CPPA request; first general submission April 1, 2028 for 2026–2027 assessments (§ 7157)
Pre-2026 activities	Businesses with processing initiated before 2026 must complete risk assessment by December 31, 2027 (§ 7155(b))

Penalties

Violation	Fine
Per violation	$2,500 standard; $7,500 intentional

Sources: CPPA Regulations

Cite this regulation

Permalink: https://everyailaw.com/regulation/california-ccpa-admt/

JSON: https://everyailaw.com/api/v1/regulations.json

Attribution: EveryAILaw, PAICE.work PBC. “California CCPA ADMT Regulations”, EveryAILaw.com, May 21, 2026. https://everyailaw.com/regulation/california-ccpa-admt/

Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.