California regulators have approved new, far-reaching regulations targeting the use of Automated Decision-Making Technology (“ADMT”) under the California Consumer Privacy Act (“CCPA”). These rules require businesses to issue pre-use notices, honor opt-out rights, and conduct detailed cybersecurity audits and risk assessments when using ADMT to make “significant decisions” affecting individuals, such as employment, healthcare, housing, or education. The regulations are expected to take effect after review by the Office of Administrative Law and impose compliance deadlines beginning in 2027.
Under the new framework, businesses must identify ADMT tools used to make significant decisions and provide consumers, employees, or job applicants with clear disclosures on how the technology works, how to opt out, and how to access related data. Additionally, companies must complete risk assessments for high-impact data uses, including profiling, behavioral tracking, and use of ADMT in sensitive locations or decision-making contexts. These assessments must weigh the privacy risks against business and public benefits and be submitted to regulators on a rolling basis starting in 2028.
Businesses engaged in high-risk data processing must also conduct annual cybersecurity audits. These requirements will be phased in based on company size and data practices, with first audits due as early as 2028 for larger companies. To prepare, companies should begin reviewing internal data processes, engage experienced counsel, and consider proactive “dry run” audits to identify and close compliance gaps.
If you have any questions about how these new regulations may impact your business or need assistance preparing for compliance, please contact us at info@mnklawyers.com.
