United States of America: Regulation under California Consumer Privacy Act on automated decision-making technology enters into force
Description
Regulation under California Consumer Privacy Act on automated decision-making technology enters into force
On 1 January 2027, the Regulation under California Consumer Privacy Act (CCPA) on automated decision-making technology (ADMT) enters into force. The rules apply to businesses using ADMT for significant consumer decisions in areas including employment, housing, credit, health care, education, insurance, and essential goods. Automated decision-making technology is defined broadly to include machine learning models, rule-based scoring systems, facial recognition, advanced spreadsheets, and profiling. Businesses must provide a detailed pre-use notice, offer opt-out or human review, and disclose information on ADMT logic and outputs.
Original sourceScope
Policy Area
Consumer protection
Policy Instrument
User/subject right
Regulated Economic Activity
ML and AI development
Implementation Level
subnational
Government Branch
executive
Government Body
data protection authority
Complete timeline of this policy change
Hide details
2023-11-27
under deliberation
2024-02-23
under deliberation
2024-11-22
in consultation
2025-01-14
processing consultation
2025-03-28
under deliberation
2025-09-23
adopted