CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits

Partly in forceRegulationBinding

Updates the California Consumer Privacy Act regulations to give consumers rights to pre-use notice, opt-out and access when businesses use automated decision-making technology for significant decisions (e.g. employment, lending, housing, health care, education), and requires risk assessments and annual cybersecurity audits for high-risk processing. Applies to businesses subject to the CCPA.

Why it matters

Companies using AI to make or substantially replace human decisions about Californians need ADMT notices, opt-out/appeal paths and documented risk assessments.

What it requires

Impact assessmentConsumer rightsTransparency to usersData governance

Penalties

CCPA administrative fines of $2,500 per violation or $7,500 per intentional violation (inflation-adjusted)

SourceCalifornia Privacy Protection Agency: https://cppa.ca.gov/regulations/ccpa_updates.html Checked against the source on 4 Oct 2026. Approved by the Office of Administrative Law 22 Sep 2025; regulations effective 1 Jan 2026 with phased compliance (ADMT 1 Jan 2027; risk-assessment attestations and audits later).

Cite this record

CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. California Privacy Protection Agency (CPPA). Status: Partly in force. wheresthe.ai, https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/ (verified 4 Oct 2026).

Line of Thought

Developments connected to this rule

What has happened that this rule shapes, or that shapes it. Pick one to keep following the thread.

DevelopmentAnthropic launches Claude for Healthcare with HIPAA-ready tools for providers and payers11 Jan 2026 · Launch · US
DevelopmentCalifornia bans AI-only firing and requires notice of AI-driven mass layoffs30 Sep 2026 · Rule change · US-CA
DevelopmentWashington law says only a licensed clinician can deny prior-authorisation requests23 Mar 2026 · Rule change · US-WA, US
DevelopmentEU pushes AI Act duties for hiring and workplace AI back to December 20278 Jul 2026 · Rule change · EU
DevelopmentCalifornia finalises civil-rights rules for AI in hiring, effective 1 Oct 202527 Jun 2025 · Rule change · US-CA
DevelopmentStanford ADP data: young-worker jobs in AI-exposed roles now 19% below peers12 Aug 2026 · Research · US

CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits

Why it matters

What it requires

Penalties

Cite this record

Developments connected to this rule

More from California