California Gives Final Approval to New Regs on Use of Automated Decision-Making Tools

“The regulations provide clarity for businesses, while ensuring strong protections for Californians,” said Phil Laird, General Counsel for the California Privacy Protection Agency. “Our goal has always been to give consumers meaningful rights and also provide practical compliance pathways for businesses.”

The new regs define ADMT as any technology that processes personal information and uses computation to replace or substantially replace human decision making. The rules apply to its use to make “significant decisions,” which are defined as decisions that result “in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.”

The rules, which CPPA approved unanimously in July, do not prohibit the use of ADMT outright. But they require businesses to provide consumers with certain notice of its use, the ability to opt-out and access to data on request. Businesses must also perform and report regular safety evaluations.

Outsourcing the use of ADMT also does not insulate companies from liability under the new rules. Businesses will be required to conduct oversight of third-party compliance.

The inclusion of ADMT under the state privacy law carries echoes of a provision of the Colorado AI Act passed in 2024. The Colorado law targets the use of “automated decision-making systems” for “consequential decisions,” similar to those included in the new California rules.

The Colorado law is currently in limbo as the governor and lawmakers try to hash out tweaks to the legislation before it takes effect next year.

“The rules add clarity to some important questions, like how the application of California’s privacy law to employees should be considered,” Cobun Zweifel-Keegan, managing director of the data-privacy non-profit told Statescoop. “There will be operational impacts beyond the major updates, but those big pieces like cybersecurity audits and automated decision making systems should be a top priority for privacy teams to review.”

Kristian Stout, director of innovation policy at the International Center for Law and Economics, disagreed, telling Statescoop, “While the CPPA was reasonable in its interest in looking at these rules in light of new technologies, the core framework remains rigid and risks placing California at a competitive disadvantage in AI leadership.”

ADMT is one of the fastest growing use cases for AI in business and curbs on its use could be a blow to AI developers targeting enterprises.

The new California rules, along with the wrangling in Colorado, come as technology companies and investors are stepping up their political spending in states in the face of a proliferation of state AI regulations around the country.

Meta this week unveiled a new non-federal super PAC backed by tens of millions of dollars to support AI and tech-friendly candidates in state legislative elections. In August, in launched Meta California, a super PAC specifically targeting Golden State elections, also backed by tens of millions of dollars.

Separately, A16z and OpenAI co-founder Greg Brockman each put $50 million into a new super PAC that also plans to target statehouse races around the country.