On September 22, 2025, California approved final privacy regulations giving people notice, access, and opt-out rights for specified automated decisions. The package became effective January 1, 2026. Businesses using covered technology for significant decisions must comply with its requirements for automated decisionmaking technology, or ADMT, beginning January 1, 2027, as the California Privacy Protection Agency explains.
The threshold is easy to misunderstand. A business can use AI without triggering these particular rights. A business can also place a person in the workflow without taking the decision outside the rules.
The question is what the technology does with personal information and what the human actually contributes. A product label cannot establish either fact.
ADMT Means Replacement of Human Decisionmaking
Under section 7001(e) of the final regulations, automated decisionmaking technology, or ADMT, processes personal information and uses computation to replace or substantially replace human decisionmaking. Substantial replacement means using the output to decide without the human involvement specified in that definition.
The definition is functional. It does not require a chatbot, a particular machine-learning technique, or software marketed as AI. Qualifying profiling is included. Specified supporting technologies, including web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, databases, and spreadsheets—are excluded.
Neither the presence of a score nor the presence of a person is conclusive. The business must examine how the output becomes a decision. Does the software determine the result? Does a person analyze the recommendation and relevant evidence? Can that person change what happens?
A Signature Does Not Establish Human Involvement
The reviewer must satisfy three cumulative conditions: know how to interpret and use the output; review and analyze it alongside any other information relevant to making or changing the decision; and have authority to make or change the decision based on that analysis.
The second condition describes work actually performed. Training someone to understand a score does not establish that they examined it in a particular decision. Authority matters separately: a reviewer who recognizes an error but cannot change the result does not satisfy all three conditions.
Consider three hypothetical uses of an applicant-screening tool by an otherwise covered business. In the first, the system automatically rejects applicants below a threshold. That illustrates replacement of human decisionmaking.
In the second, a manager clicks approve on the rejection list without examining relevant information. The added click does not establish the required human involvement. Describing the product as decision support does not change the manager’s conduct.
In the third, a manager understands the output, analyzes it with relevant applicant information, and has authority to decide differently. Those facts support a different analysis under the ADMT definition. The conclusion depends on the actual process, not a policy promising that managers remain responsible.
The Decision Must Also Fall Within the Covered Categories
Meeting the ADMT definition is one threshold. Section 7200 applies the article to a business using ADMT to make a significant decision concerning a consumer, including decisions concerning provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, and healthcare services. The accompanying definitions supply further limits. The housing definition, for instance, provides that technology providing or denying housing based solely on the availability or vacancy of the housing, or on the successful receipt of payment, is not making a significant decision. Advertising to a consumer is excluded from significant decision.
For education, the definition identifies admission or acceptance, credentials, suspension, and expulsion. It does not automatically turn every automated classroom exercise into a covered significant decision. Likewise, software that helps organize work requires examination of the particular decision it makes, rather than an assumption based on the importance of employment generally.
The Organization and Information Must Be Covered Too
These regulations operate under the California Consumer Privacy Act. The Agency’s FAQs explain that it generally covers qualifying for-profit businesses, not government agencies or nonprofits. Its consumers include California residents in employment contexts; consumer does not mean only a retail customer.
Healthcare and education organizations must therefore check their status and the information involved before promising these rights or concluding they do not apply. Certain information, including specified medical information, is exempt. Healthcare status alone is not a substitute for examining the relevant exemption and its conditions.
A public school and a covered commercial educational provider do not start with identical CCPA coverage. Within an organization, patient information and employee information can require different analyses. Identifying healthcare or education in the significant-decision definition does not erase these thresholds.
The Notice Must Explain the Actual Use
For covered uses, section 7220 requires a pre-use notice addressing the specific purpose, applicable rights, and how the technology works in the decision process. Timing depends on collection and proposed use; information collected earlier for another purpose requires notice before the covered ADMT processing begins.
A statement that the business uses technology to improve services does not tell a person whether software will determine admission, compensation, or access to care. The notice must make the particular decision understandable. It also addresses the output’s role and any human participation that falls short of the defined human involvement.
As a practical matter, the business needs to know its own process before it can describe it accurately. The applicant-screening vendor can explain the score. The employer must explain how it uses that score and what its managers do.
Access Concerns the Person’s Decision
Section 7222 requires plain-language information in response to an access request about the specific purpose, the logic involved, and the outcome, including how the business used the output for that person. Specified trade-secret and security-related limitations apply.
This is not an unrestricted right to inspect source code or obtain the vendor’s entire model. It concerns an explanation that helps the person understand how their information produced an output and how the output affected the decision.
In the applicant example, a general brochure explaining that the product finds strong candidates would not answer how the business used the individual’s result. Preparing a useful response requires connecting the technology’s operation with the business’s decision.
