Skip to content
AI Policy Generator

ESWhat applies

California · Regulation

CCPA regulations on automated decisionmaking technology (ADMT) and risk assessments

In forceCCPA ADMT and risk assessments

Summary

The CCPA regulations require risk assessments before high-risk processing, such as using ADMT for significant decisions (lending, housing, education, employment and health care). From January 1, 2027, businesses using ADMT for those decisions must give a pre-use notice, offer an opt-out or a human appeal, and answer access requests about the logic used. Summaries of 2026 and 2027 assessments are due to the agency by April 1, 2028.

Who it applies to

Businesses subject to the CCPA: annual revenue above the statutory threshold (about $26.6 million in 2025, inflation-adjusted), or data on 100,000 or more California residents or households, or at least 50% of revenue from selling or sharing personal information.

Penalties

Up to $2,500 per violation and $7,500 per intentional violation or violation involving minors (inflation-adjusted).

Official name
California Code of Regulations, Title 11, Division 6, Chapter 1 (CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology, and Insurance Regulations)
Official reference
11 CCR §§ 7150-7157 y 7200-7222; aprobado por la OAL el 22 de septiembre de 2025; vigente el 1 de enero de 2026
Regulator
California Privacy Protection Agency (CalPrivacy / CPPA) and California Attorney General
Official source
Check the sourceHow we verify sources

Key dates

Obligations and dates

Obligations table
ObligationArticle or citationStatusDateWho it applies toVerification
Risk assessment before using ADMT or other high-risk processing11 CCR §§ 7150, 7151, 7152, 7155In forceJanuary 1, 2026Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.Verified in the official source on November 2, 2026
Submit assessment information to the agency with a signed attestation11 CCR § 7157Adopted, applies laterApril 1, 2028Applies to businesses that conducted risk assessments in 2026 or 2027.Verified in the official source on November 2, 2026
Pre-use notice for ADMT11 CCR §§ 7200(b), 7220Adopted, applies laterJanuary 1, 2027Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.Verified in the official source on November 2, 2026
Offer an ADMT opt-out or a human appeal11 CCR § 7221Adopted, applies laterJanuary 1, 2027Applies to CCPA-covered businesses that use ADMT for significant decisions.Verified in the official source on November 2, 2026
Respond to ADMT access requests11 CCR § 7222Adopted, applies laterJanuary 1, 2027Applies to CCPA-covered businesses that use ADMT for significant decisions.Verified in the official source on November 2, 2026

Risk assessment before using ADMT or other high-risk processing

11 CCR §§ 7150, 7151, 7152, 7155In force

Applies from January 1, 2026

When it relates
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
  • Conduct and document the assessment before starting the processing.
  • Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
  • Have it approved by a person with authority over the processing.
  • Review it at least every three years and update it within 45 days of a material change.
  • Keep it while the processing continues or for five years after completion, whichever is later.
  • For processing that already existed before January 1, 2026, the deadline is December 31, 2027.
Typical evidence
  • Signed, versioned risk assessment
  • List of contributors and approver
Verification
Verified in the official source on November 2, 2026Checked against the approved text published by CalPrivacy (§§ 7150 and 7155).

Submit assessment information to the agency with a signed attestation

11 CCR § 7157Adopted, applies later

Applies from April 1, 2028

When it relates
Applies to businesses that conducted risk assessments in 2026 or 2027.
What the rule provides
  • Submit the required information on 2026 and 2027 assessments by April 1, 2028, and every April 1 after that.
  • Include an attestation signed by an executive under penalty of perjury.
  • Provide the full assessment within 30 days if the agency or Attorney General requests it.
Typical evidence
  • Submitted form and confirmation
  • Signed attestation
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7157(a)(1)).

Pre-use notice for ADMT

11 CCR §§ 7200(b), 7220Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions on lending, housing, education, employment or health care.
What the rule provides
  • Before using ADMT, explain the specific purpose, the right to opt out or appeal, the right of access, and how the ADMT works.
  • Explain in plain language which data affect the output and how the decision would be made if the person opts out.
  • Uses that began before 2027 must comply by January 1, 2027; new uses from first use.
Typical evidence
  • Published or delivered pre-use notice
Verification
Verified in the official source on November 2, 2026Date checked against the approved text (§ 7200(b)); notice content per § 7220.

Offer an ADMT opt-out or a human appeal

11 CCR § 7221Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Offer at least two ways to opt out, without requiring an account.
  • Or, instead, offer an appeal reviewed by a person with authority to change the decision, if the exception's conditions are met.
  • State in the notice which exception you rely on.
Typical evidence
  • Opt-out or appeal form and request log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§§ 7220 and 7221).

Respond to ADMT access requests

11 CCR § 7222Adopted, applies later

Applies from January 1, 2027

When it relates
Applies to CCPA-covered businesses that use ADMT for significant decisions.
What the rule provides
  • Explain the specific (not generic) purpose for which ADMT was used about that person.
  • Explain the ADMT's logic, the output produced and how it was used in the decision.
Typical evidence
  • Access response template and response log
Verification
Verified in the official source on November 2, 2026Checked against the approved text (§ 7222).

Related rules

Regulatory change alerts by country

Pick the countries you care about and we will email you when we change a rule or an application date for those countries in our registry.

  • Changes to the rules of the countries you pick, when we add them to the registry.
  • New application dates.
  • No more than one email a week. Unsubscribe at any time.

It is a free, informational notice, not a legal monitoring service: it does not necessarily catch every change or within a set time.

Countries · Pick one or more.
US states
Email language
Manage my alerts

Find out what applies to you (free)