United States of America: Office of Administrative Law adopted regulations under California Consumer Privacy Act on automated decision-making technology
Description
Office of Administrative Law adopted regulations under California Consumer Privacy Act on automated decision-making technology
On 23 September 2025, the California Office of Administrative Law adopted the regulations under California Consumer Privacy Act (CCPA) on automated decision-making technology (ADMT). The rules apply to businesses using ADMT for significant consumer decisions in areas including employment, housing, credit, health care, education, insurance, and essential goods. Automated decision-making technology is defined broadly to include machine learning models, rule-based scoring systems, facial recognition, advanced spreadsheets, and profiling. Businesses must provide a detailed pre-use notice, offer opt-out or human review, and disclose information on ADMT logic and outputs.
Original sourceScope
Policy Area
Consumer protection
Policy Instrument
User/subject right
Regulated Economic Activity
ML and AI development
Implementation Level
subnational
Government Branch
executive
Government Body
data protection authority
Complete timeline of this policy change
Hide details
2023-11-27
under deliberation
2024-02-23
under deliberation
2024-11-22
in consultation
2025-01-14
processing consultation
2025-03-28
under deliberation
2025-09-23
adopted