California ADMT Rules
California’s privacy regulator, the California Privacy Protection Agency (now branded CalPrivacy), finalized its automated decisionmaking technology rules in September 2025. They took legal effect on January 1, 2026, but the consumer-facing duties carry a later date. A business already using ADMT for a covered decision must comply by January 1, 2027, and any tool switched on after that date must comply from its first use.
ADMT means software that processes personal information and uses computation to replace, or substantially replace, human decisionmaking. A resume ranker that auto-rejects the bottom 60% of applicants qualifies. A spreadsheet a loan officer reads before making her own call does not.
The duties attach only to what the regulation calls a “significant decision”: financial or lending services, housing, education enrollment or opportunity, employment or independent contracting, and healthcare services. Advertising was dropped from the final text, along with the broad profiling category from earlier drafts.
Three obligations arrive together: a pre-use notice (section 7220 of Title 11, California Code of Regulations), an opt-out right (7221), and a right to learn how the tool was used on you (7222). They bind for-profit companies that meet a CCPA threshold, such as gross annual revenue above $26,625,000 or personal information on 100,000 or more California consumers or households.
Where Teams Go Wrong
The most common misreading is that a human somewhere in the process takes the tool out of scope. The regulation sets a three-part test for human involvement. The reviewer must know how to interpret the output, must actually analyze it alongside other relevant information, and must hold authority to make or change the decision. A recruiter who clicks “approve” on 300 machine-ranked rejections in ten minutes fails the second part, and if that reviewer has never overturned a single score in a year, well.
Second misreading: “our vendor handles this.” The business that deploys the tool owns the obligation, even when the model sits inside a third-party applicant tracking system or underwriting platform. Writing a notice requires facts only the vendor holds, such as which input categories drive the output, which, frankly, most HR teams have never asked their vendor.
Third, employees, job applicants, and contractors count as consumers under the CCPA. Hiring and pay tools therefore produce much of the exposure, not customer-facing products.
The work also depends on things outside the ADMT sections. You need a current data inventory, a request-intake system that can verify identity, and a risk assessment for each covered use. That assessment runs on its own track under sections 7150 to 7157.
Steps Before January 1
Inventory Every Automated Decision
List each system that scores, ranks, approves, denies, or prices people in the five covered areas. For each one, record the vendor, the inputs, the output type (score, tier, yes or no), and what a human does with it. Check the live configuration, because the vendor’s sales deck rarely matches what is actually running. Auto-reject thresholds and knockout questions are the usual hidden triggers.
Choose Opt-Out Or Human Appeal
The default is an opt-out offered through at least two methods, one of which matches how you normally deal with the person. Once someone opts out, processing must stop as soon as feasible and no later than 15 business days.
The alternative is the human appeal exception. If a qualified reviewer with authority to overturn the result will reconsider it on request, no opt-out is owed. Narrower exceptions cover hiring, admission, work allocation, and compensation decisions, on the condition that the tool works for that purpose and does not unlawfully discriminate. Relying on those means keeping validation evidence on file.
Draft The Pre-Use Notice
The notice must appear before the tool is used and can sit inside your existing notice at collection. It has to state the specific purpose, how to opt out or appeal, the access right, and that you will not retaliate. It must also explain how the tool works: which categories of personal information affect the output, what kind of output it produces, and how that output feeds the decision. Trade secrets can stay out. “We use AI to improve our services” does not pass.
Build The Access Workflow
On request, you must explain the purpose, the logic in plain terms, and the outcome for that individual. Standard CCPA timing applies: 45 calendar days to respond, with one 45-day extension if you tell the requester why. Privacy request platforms such as OneTrust or Transcend can route the ticket, but someone still has to pull the person’s actual score and write the explanation. You draft the notice, wire up two opt-out channels, and the access queue needs an owner.
Two Worked Examples
A staffing agency. A 140-person agency in Sacramento screens warehouse applicants with a resume-scoring feature that auto-declines anyone below a set score. No recruiter sees declined files, so the tool replaces human judgment. The agency chooses the human appeal route: declined applicants get a link to request review, and a senior recruiter reads the full application and can reverse the result. It adds an ADMT section to the applicant notice and logs every appeal with its outcome.
A dental group. A twelve-clinic group offers in-house payment plans approved by an automated model. That is a financial services decision. Patient treatment records governed by HIPAA or California’s medical confidentiality law sit outside the CCPA, but the financing data does not. The group offers an opt-out by web form and at the front desk, with manual underwriting as the fallback. Manual review takes two business days instead of two minutes, and the notice says so.
Compliance Checklist
| Task | What The Rule Requires | Date | Evidence To Keep |
|---|---|---|---|
| ADMT inventory | Identify every tool that replaces or substantially replaces human judgment in a covered decision | Before January 1, 2027 | System list with inputs, outputs, reviewer role |
| Pre-use notice | Purpose, logic summary, opt-out or appeal route, access right, no-retaliation statement | January 1, 2027 | Dated notice versions, screenshots of placement |
| Opt-out or appeal | Two opt-out methods with a 15-business-day stop, or a human appeal with authority to overturn | January 1, 2027 | Request log, reviewer training record, reversal counts |
| Access requests | Explain purpose, logic, and individual outcome within 45 days | January 1, 2027 | Response templates, completed tickets |
| Risk assessment | Weigh benefits against privacy harms before starting; uses that predate 2026 get extra time | December 31, 2027 for pre-2026 uses | Signed assessment, kept at least five years |
| Agency filing | Submit attestation and summary of assessments from 2026 and 2027 | April 1, 2028 | Submission receipt, executive sign-off |
Common Mistakes
Treating a privacy policy update as the notice. The pre-use notice must reach the person at or before collection for that use, not sit in a footer link they never open.
Hiding the opt-out behind a cookie banner. The agency’s text rules this out, and a banner built for ad tracking says nothing about hiring or lending anyway.
Claiming the human appeal exception without staffing it. An appeal inbox nobody monitors is worse than no exception, because the notice now contains a false statement.
Waiting on the risk assessment because its filing date is 2028. New covered uses started in 2026 needed an assessment before launch. Material changes to a tool trigger an update within 45 calendar days, and every assessment gets a review at least once every three years.
Forgetting penalties scale per violation. Administrative fines run up to $2,663 per violation and $7,988 for intentional ones or those involving minors, figures last adjusted for inflation in January 2025.
FAQ
Does the ADMT rule apply to companies outside California?
Yes, if the company meets a CCPA threshold and makes covered decisions about California residents. A Texas employer hiring remote staff in San Diego falls inside the rule for those applicants.
Is ChatGPT or a similar chatbot considered ADMT?
Only when its output replaces or substantially replaces a human decision in a covered area. Drafting job descriptions with a chatbot is outside scope. Letting it reject applicants is inside.
Can a business refuse an ADMT opt-out request?
It can if a listed exception applies, such as a working human appeal process or a validated hiring tool used only for that purpose. The business must tell the person which exception it relies on.
What can I ask a company about an automated decision?
From January 1, 2027, you can ask what the tool was used for, how its logic works in general terms, and what outcome it produced for you. Expect an answer within 45 days.
Do small businesses have to comply?
Only those that meet a CCPA threshold. A company under $26,625,000 in revenue that handles fewer than 100,000 Californians’ records and does not earn half its revenue from selling or sharing data is outside the law.
Author’s Insight
Reading the final text against the 2023 and 2024 drafts, the agency clearly narrowed the definition, and the weight now rests on one phrase: “substantially replace.” That makes the reviewer’s real behavior the deciding evidence, more than any contract label calling a tool “decision support.” Override rates, time spent per file, and reviewer training records are what an investigator would ask for first. Companies that measure those numbers now will know which side of the line they stand on before anyone else asks. Those that do not are guessing, and the notice they publish in January will carry that guess in writing.
Key Takeaways
- January 1, 2027 is the date for pre-use notice, opt-out or appeal, and access rights on tools already in use.
- Scope turns on two questions: does the decision fall in the five covered areas, and does software replace or substantially replace human judgment.
- Human review counts only when the reviewer understands the output, examines it, and can change the result.
- The deploying business answers for vendor tools, so request input, output, and logic documentation in writing.
- Risk assessments follow separate dates: December 31, 2027 for older processing and April 1, 2028 for the first filing.
- This article is general education, not legal advice. Borderline tools deserve a lawyer’s read of sections 7200 to 7222.
