California's rules on automated decisionmaking technology (CCPA regulations)
BuildAIPolicy Research · Added 27 October 2026 · Last checked 27 October 2026
What it is
The California Privacy Protection Agency's regulations took effect on 1 January 2026. Businesses that use automated decisionmaking technology to make significant decisions about consumers must meet the ADMT requirements from 1 January 2027. Risk assessment requirements began on 1 January 2026.
Who it affects
Businesses covered by the CCPA that use automated decisionmaking technology for significant decisions about California residents.
What to consider
- Check whether you're covered by the CCPA.
- Identify significant decisions made using automated tools, and prepare the required notices and opt-out or appeal processes.
Sources
Put rules like this into practice
The AI Policy & Risk Pack gives your organisation an AI use policy, a risk register, an AI tool inventory and notice wording, written from how you use AI. Preview every section free before you pay. It isn't legal advice.
A general summary of public information, checked against the sources listed on the date shown. It isn't legal advice and may not cover every rule that applies to you. Check the sources, and get professional advice for your situation.