CPPA Approves New Rules for Automated Decision Making

New regulations are coming to companies subject to the California Consumer Privacy Act. The California Privacy Protection Agency (CPPA) has recently voted unanimously to adopt new regulations focused on pre-use notices, opt-out rights, cybersecurity audits, and risk assessments. One area of interest is new notice requirements for businesses using Automated Decision-Making Technologies (ADMTs) for significant decisions. A recent Fisher Phillips memo discusses the new rules and defines “significant decisions within the context of the new regulations:

“A significant decision results in the provision or denial of the following services:

• Financial or lending services (the extension of credit or a loan; transmission or exchanging funds; the provision of deposit or checking accounts; check cashing; or installment payment plans).
• Housing, although the use of an ADMT that provides or denies housing to a consumer based solely on the availability or vacancy of the housing or the successful receipt of payment for housing from the consumer is not making a significant decision.
• Education enrollment opportunities (admission or acceptance into academic or vocational programs; educational credentials such as a degree, diploma, or certification; and suspension or expulsion).
• Employment or independent contracting opportunities or compensation (hiring; allocation/assignment of work and compensation; promotion; demotion, suspension, and termination).
• Healthcare services.”

If you’re business uses ADMTs to make significant decisions, then the memo explains that you must provide notice covering all of the following areas:

• “the purpose for which the ADMT is being used;
• how to opt out (or, if there is an exception to the opt-out right, an explanation of how to appeal the ADMT decision to a human reviewer);
• a description of the consumer’s right to access relevant ADMT data and how to exercise that right;
• non-retaliation rights under the California Consumer Privacy Act;
• and a description of how the ADMT works to make a significant decision and how the significant decision would be made if the consumer opts out.”

Companies currently using ADMTs have until January 1, 2027, to provide notice. Companies employing ADMTs after that date must provide notice before the ADMT enters into use. These regulations are another example of how states are leading the way in AI regulation. We’ve previously written about the legal risks posed by automated decision-making systems, and these new California regulations introduce additional compliance risks to manage. Compliance teams subject to CPPA regulations should review their use of ADMTs and determine their obligations under the new rules.