California finalizes CCPA rules on automated decisionmaking technology

California's privacy regulator finalized a package of regulations under the California Consumer Privacy Act that create new rules for automated decisionmaking technology, known as ADMT, along with risk assessments and cybersecurity audits.

The California Office of Administrative Law approved the final text on September 22, 2025, after the agency's board had adopted the regulations on July 24, 2025.

What it is

The package updates existing CCPA rules, adds consumer rights to access and opt out of a business's use of ADMT, requires risk assessments and annual cybersecurity audits, and clarifies when insurance companies must comply with the CCPA.

The regulations define ADMT as any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.

A decision stays outside ADMT only if a human reviewer knows how to interpret and use the technology's output to make the decision.

The regulations go into effect January 1, 2026, though several obligations are phased in over following years.

What it requires

Beginning April 1, 2027, businesses using ADMT for a significant decision must give consumers a pre-use notice about the business's use of ADMT for a significant decision.

They must also provide an opt-out option to California consumers, subject to certain exceptions, and allow consumers to request access to information about the ADMT's logic and how its outputs were used in the decision.

Consumers must further be given the ability to appeal the results of ADMT, and the rules say significant decisions includes decisions that affect finances, housing, education, employment or health care, but not advertising.

Separately, businesses subject to risk assessment requirements must begin compliance by January 1, 2026, and one activity that triggers an assessment is using ADMT for a significant decision concerning a consumer.

Cybersecurity audit certifications are phased by revenue, with the earliest certifications due April 1, 2028, if the business makes over $100 million.

The audit requirement reaches a business that derives annual gross revenue over $25 million and processes either a large volume of personal information or sensitive personal information of at least 250,000 consumers.

What security leaders should do

Security and privacy teams should inventory where ADMT is used for hiring, lending, housing, education or health care decisions, since those are the uses that trigger the new notice, opt-out, access and appeal rights. Because the cybersecurity audit and risk assessment deadlines are tied to company revenue and the volume of personal or sensitive information processed, teams should map their organization against those thresholds now rather than waiting for the first certification dates. Given that risk-assessment compliance starts January 1, 2026, well before the ADMT-specific obligations begin on April 1, 2027, governance, legal and security functions should build shared documentation and review workflows that can serve both requirements. Audit evidence collection, vendor reviews of ADMT tools, and consumer appeal handling processes are reasonable areas to pilot before the phased deadlines arrive.