California CPPA ADMT Draft Rules Explained

While Colorado focuses on discrimination, California approaches AI regulation through the lens of privacy. The California Privacy Protection Agency (CPPA) has drafted rules interpreting the CCPA's mandate to give consumers rights over Automated Decision-Making Technology (ADMT).

What is ADMT in California?

The CPPA defines ADMT broadly. It includes any system, software, or process that uses computation (including AI or machine learning) to make or execute a decision, or facilitate human decision-making, that has a significant impact on a consumer.

This goes beyond just consequential decisions (like housing or jobs) and extends to:

• Profiling an employee, independent contractor, applicant, or student.
• Profiling a consumer in a publicly accessible place (e.g., facial recognition in a mall).
• Profiling a consumer for behavioral advertising.

The Right to Opt-Out

The cornerstone of the California rules is the consumer's right to opt-out. If a business uses ADMT for any of the covered purposes, it must provide a clear and conspicuous link titled "Limit the Use of My Sensitive Personal Information and Automated Decision-Making Technology."

Pre-Use Notices

Before processing a consumer's personal information using ADMT, a business must provide a "Pre-use Notice." This notice must explain:

• The purpose for which the ADMT is used.
• The consumer's right to opt-out.
• The consumer's right to access information about how the system works.

Risk Assessments

Businesses must conduct rigorous cybersecurity audits and risk assessments for processing activities that present a significant risk to consumers' privacy or security. The CPPA mandates a very specific structure for these assessments, requiring evaluation of the negative impacts on consumers versus the benefits to the business.

Getting Ready

The CPPA draft rules are complex and continuously evolving. Rulisto stays updated with the latest regulatory changes, allowing you to easily map your data processing activities to California's strict ADMT requirements.