Law / United States / California
CCPA Automated Decisionmaking Technology Regulations
Cal. Code Regs. tit. 11, Sections 7200 to 7222
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 8 months, effective 1 January 2026.
An AI risk obligations rule binding private bodies.
As of 8 September 2026.
What it requires
- If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
- Let a consumer opt out of your use of ADMT to make a significant decision about them, unless you offer an appeal to a human reviewer with authority to overturn the decision or another exception listed in the regulation applies
- When a consumer requests access to your use of ADMT to make a significant decision, respond with a plain-language explanation of the specified information about that use
- If you were already using ADMT for a significant decision before January 1, 2027, come into compliance with these requirements by that date; if you begin such use on or after that date, be in compliance from the start
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Enforced by the California Privacy Protection Agency or the Attorney General under the CCPA's general enforcement authority (Civil Code Section 1798.185); this article states no ADMT-specific penalty amount of its own.
What it reaches
Obligation class
Data subject rights, DPIA, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 11 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on 24 July 2025, approved by the Office of Administrative Law and filed with the Secretary of State on 22 September 2025, and effective 1 January 2026 per the Agency's own regulations page, governs a business's use of automated decisionmaking technology (ADMT) to make a 'significant decision' about a consumer, defined as a decision granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services.
A business using ADMT for a significant decision must give consumers a Pre-use Notice describing the use and the consumer's rights to opt out of and access information about that use (Section 7220), must let a consumer opt out of that use except where the business offers an appeal to a human reviewer empowered to overturn the decision or another listed exception applies (Section 7221), and must respond to a consumer's request to access ADMT with a plain-language explanation of the specified information about that use (Section 7222).
A business using ADMT for a significant decision before 1 January 2027 has until that date to come into compliance with this article; a business beginning such use on or after 1 January 2027 must already be in compliance. Confirmed against the Agency's own approved regulation text, which places the automated-decisionmaking-technology article at Sections 7200 to 7222, not the 7040-to-7057 range sometimes cited for it.
When LexLint raises it
high_risk_decisions
Read the law
official California Privacy Protection Agency (CPPA) approved rulemaking text