Only businesses that use automated decision-making technology (ADMT) to make significant decisions about California consumers, such as hiring, lending, housing, education or healthcare decisions, must meet the new ADMT rules, and they must do so from 1 January 2027. The California Privacy Protection Agency (CPPA) finalised these regulations, together with rules on risk assessments and cybersecurity audits, in September 2025, and the package took effect on 1 January 2026. As of October 2026, the ADMT deadline is less than 11 weeks away.
California's approach marks a major shift in how US state privacy laws handle artificial intelligence. Any technology that replaces or substantially replaces human decision-making for those significant decisions now falls under specific notice, opt-out and access rules. Targeted advertising does not: the approved regulation text states that a significant decision does not include advertising to a consumer.
Failing to prepare for the 2027 deadline risks penalties under the California Consumer Privacy Act (CCPA), up to $2,663 per violation or $7,988 per intentional violation.
The CPPA's rulemaking page lists the final package, and the regulations define ADMT as any technology that processes personal information and uses computation to replace human decision-making or substantially replace it. When you use such a system for what the CPPA calls a "significant decision", the new rules give consumers specific rights. A significant decision is one that results in the provision or denial of financial or lending services, housing, education enrolment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services.
What counts as automated decision-making technology
The legal definition of ADMT under the CCPA is not limited to generative artificial intelligence or complex machine learning models. A simple rules-based script that decides loan or housing eligibility without a person can qualify. The regulations exclude everyday tools such as web hosting, caching, website loading, firewalls, spam filters, spellcheckers, calculators, databases and spreadsheets, as long as they do not replace human decision-making.
The rules target technology that replaces human decision-making, or substantially replaces it, which the regulations define as using the technology's output to make a decision without human involvement. An earlier draft also covered tools that "substantially facilitate" a human's decision, but that wording was dropped from the final text.
Human involvement has a precise meaning. The reviewer must know how to interpret and use the technology's output, must review and analyse that output together with any other relevant information, and must have the authority to make or change the decision based on that analysis. Rubber-stamping an algorithmic recommendation does not count. Documentation showing how your staff review the automated outputs is the practical way to show the human really decided.
Profiling counts as ADMT only when it replaces or substantially replaces human decision-making. The CPPA defines profiling as automated processing of personal information to evaluate, analyse or predict personal aspects of a person, such as performance at work, economic situation, health, preferences or behaviour.
Three ADMT obligations from 1 January 2027
The updated CCPA regulations introduce three obligations for businesses that use ADMT for significant decisions. You must provide a pre-use notice, offer a way to opt out, and give consumers access to information about how the technology was used for them.
The pre-use notice works as a just-in-time disclosure for California consumers. You must present it before your business processes their personal information using ADMT. It must state the specific purpose for which the technology is used and describe the rights available, including how to opt out. Generic wording, or a notice buried in a long privacy policy, does not meet the standard.
The opt-out right means building a way for consumers to refuse the automated processing. A business that interacts with consumers online must at least offer an interactive form reached through an opt-out link in the pre-use notice, titled to say what the consumer is opting out of, such as "Opt-out of Automated Decisionmaking Technology".
If a consumer opts out before you start, you must not start. If a consumer submits an opt-out request after you have initiated the processing, you must stop using that personal information in the ADMT as soon as feasibly possible, and within 15 business days at the latest. You must also notify the service providers, contractors and other persons you made the information available to. A cookie banner does not handle these requests: they belong in the application, portal or process where the significant decision is made.
Consumers also gain the right to access plain-English explanations of how the ADMT was used for them, including what role its output played in the decision. Your engineering teams cannot rely on algorithms that offer no visibility into their decision logic. If you cannot explain how a system arrived at its output, you will struggle to answer an access request for a significant decision in California.
When the opt-out does not apply
The final rules let a business skip the ADMT opt-out in three situations, and security or fraud prevention is not one of them.
- A human appeal: the business offers a way to appeal the decision to a human reviewer who can overturn it, knows how to interpret the technology's output and considers the information the consumer provides.
- Admission, acceptance or hiring: the ADMT is used only to assess the consumer's ability to perform at work or in an educational programme, works for that purpose and does not unlawfully discriminate.
- Allocation of work and compensation: the ADMT is used only to allocate or assign work or set compensation, works for that purpose and does not unlawfully discriminate.
An exception removes the opt-out only. The pre-use notice and the access right still apply.
Risk assessments and cybersecurity audits
Alongside the ADMT requirements, the CPPA finalised rules for privacy risk assessments and annual cybersecurity audits. The board adopted the package on 24 July 2025, the California Office of Administrative Law approved it on 22 September 2025, and the CPPA announced the approval on 23 September 2025, with the rules in force from 1 January 2026.
Businesses must conduct a risk assessment before starting any covered processing from 1 January 2026, and submit their first attestations and summaries to the CPPA by 1 April 2028. For processing that began before 2026 and continues, the assessment is due by 31 December 2027. Using ADMT for a significant decision is one trigger. Selling or sharing personal information is another, which brings many websites with advertising cookies into scope even if they never use ADMT.
The cybersecurity audit requirements follow a phased schedule based on annual gross revenue. A business whose 2026 revenue was more than $100 million must complete its first audit, covering 2027, by 1 April 2028. Smaller businesses get one or two more years.
| Annual gross revenue | First audit due | Audit period |
|---|---|---|
| More than $100 million in 2026 | 1 April 2028 | 1 Jan 2027 to 1 Jan 2028 |
| $50 million to $100 million in 2027 | 1 April 2029 | 1 Jan 2028 to 1 Jan 2029 |
| Less than $50 million in 2028 | 1 April 2030 | 1 Jan 2029 to 1 Jan 2030 |
The CCPA regulation deadlines from 2026 to 2030
Conducting a CCPA privacy risk assessment
The risk assessment rules require businesses to document their data practices before the processing starts. You must identify the categories of personal information processed, including sensitive data such as racial origin, health status or precise geolocation. The documentation must set out the benefits of the processing alongside its potential negative impacts on consumers.
Negative impacts can include economic harm, discrimination, psychological harm and reputational damage. You must describe the safeguards your teams have put in place to reduce these risks.
According to the regulations, the goal of a risk assessment is to restrict or prohibit processing when the risks to consumers' privacy outweigh the benefits to the consumer, the business, other stakeholders and the public. Assessments are living documents. You must review them at least once every three years, and update one within 45 calendar days of a material change to the processing. You must keep each assessment, with its earlier versions, for as long as the processing continues or for five years after the assessment is completed, whichever is later.
A missing or inaccurate risk assessment can lead to a fine when the CPPA asks to see it.
What the ADMT rules mean for digital marketing
Marketing teams rely on algorithms to segment audiences and deliver targeted advertisements. Earlier drafts would have pulled behavioural advertising into the ADMT rules, but the final text did not: advertising to a consumer is not a significant decision, so an ad-targeting model does not need an ADMT pre-use notice or ADMT opt-out.
Cross-context behavioural advertising is still regulated, through the existing right to opt out of sale and sharing and the duty to honour opt-out preference signals such as Global Privacy Control. Understanding your cookie categories helps you see which trackers share data with advertising partners, and selling or sharing that data is itself a trigger for a risk assessment.
If a visitor opts out of sale and sharing, advertising tags that share their data must stop firing. That requires a setup where your consent tool tells your tag manager and backend systems about the choice. Running a scan of the scripts and cookies on your site is the first step in mapping this data flow.
How California compares with global rules
California is not the only jurisdiction tightening the rules on algorithmic decisions and profiling. These requirements parallel Article 22 of the General Data Protection Regulation, which gives people in the EU the right not to be subject to solely automated decisions with legal or similarly significant effects. The CCPA risk assessment also resembles the GDPR's data protection impact assessment, and Brazil's LGPD also sets transparency rules for decisions made by automated processing.
If you operate globally, aligning your approach across jurisdictions saves engineering time. The common thread is consistent: tell people what you do with their data and give them a way to object.
A consent management platform can handle the website side of this. You can set geographical rules that show the right notices and opt-out choices for cookies based on the visitor's location, without over-complicating the experience for visitors outside regulated regions such as California or the EU. Businesses using ADMT for significant decisions should map their data inputs and decision logic now, before 1 January 2027.
Quick answers on the CCPA ADMT rules
When do the CCPA automated decision-making rules take effect?
The final CPPA regulations took effect on 1 January 2026. Businesses that use ADMT for significant decisions must comply with the pre-use notice, opt-out and access requirements from 1 January 2027.
What is a significant decision under the CCPA?
A significant decision results in the provision or denial of financial or lending services, housing, education enrolment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Using ADMT to make these decisions triggers the ADMT rules.
Do the new CCPA rules apply to targeted advertising?
Not the ADMT rules. The final regulations state that a significant decision does not include advertising to a consumer. Ad targeting stays under the existing right to opt out of sale and sharing, including Global Privacy Control signals, and selling or sharing personal information requires a risk assessment.
When is the first CCPA cybersecurity audit due?
The earliest deadline is 1 April 2028, for businesses whose 2026 annual gross revenue was more than $100 million. That first audit covers 1 January 2027 to 1 January 2028.
How long must a business keep a CCPA risk assessment?
For as long as the processing continues, or for five years after the assessment is completed, whichever is later. Original and updated versions must both be kept.
Does Kukie.io handle CCPA opt-out requests?
Kukie.io handles the cookie side on your website: it blocks tracking scripts by category, collects and records visitors' choices, and can treat a Global Privacy Control signal as an opt-out of sale and sharing in regions where you use an opt-out model. It does not handle ADMT opt-outs for significant decisions, which belong in the system that makes those decisions.
Map what your website shares before 2027
If your website shares visitor data with advertising partners, that sharing needs an opt-out and a risk assessment, whatever you decide about ADMT. Kukie.io's free plan lets you scan the first-party and third-party trackers on your site, so you know what data leaves it and which scripts to block when a visitor opts out.
