Automated decision-making technology (ADMT) is a regulatory term for technology that processes personal information and uses computation to replace or substantially replace human decision-making. It became a defined term of art in U.S. state privacy law through regulations issued under the California Consumer Privacy Act (CCPA), and is used more broadly to describe the class of automated and AI-assisted systems that make or materially inform consequential decisions about individuals.
Definition under the CCPA regulations
The California Privacy Protection Agency (CPPA) defines ADMT as any technology that processes personal information and uses computation to replace or substantially replace human decision-making. The definition expressly includes profiling and excludes routine tasks — such as web hosting, spam filtering, and simple data organization — unless those tools are used to make a covered decision (Source: mayerbrown.com; ogletree.com).
The regulations attach obligations when ADMT is used for "significant decisions" affecting individuals — areas such as employment, housing, credit, education, and access to essential goods and services. Covered businesses must provide a pre-use notice describing the use of ADMT, offer a right to opt out of that use, and provide a right to access information about how the technology was applied to the individual (Source: skadden.com; paulhastings.com).
Rulemaking and effective dates
The CPPA completed the ADMT rulemaking on September 22, 2025, as part of a package that also covered cybersecurity audits and risk assessments. The regulations began taking effect on January 1, 2026, with the ADMT-specific compliance obligations phased in so that businesses using ADMT for significant decisions must meet the notice and opt-out requirements by January 1, 2027 (Source: cppa.ca.gov; paulhastings.com).
Relationship to other regimes
ADMT obligations overlap conceptually with algorithmic accountability requirements and with the meaningful human review standards appearing in other AI-governance instruments, and they form one strand of the state-level activity discussed under AI federalism. Comparable profiling and automated-decision provisions appear in other state privacy laws and in the EU's data-protection framework, making ADMT a recurring reference point in debates over how AI-assisted decisions about individuals should be governed (Source: skadden.com).
The EU comparison
The two regimes differ in structure. The California rules attach notice, opt-out and access rights to ADMT used for significant decisions, leaving the practice permitted subject to those obligations; Article 22 of the GDPR instead states a prohibition on decisions based solely on automated processing that produce legal or similarly significant effects, subject to enumerated exceptions, and pairs it with an information duty.
The largest enforcement action taken on that prohibition to date illustrates the difference in exposure. On August 21, 2026 the Autoriteit Persoonsgegevens, the Dutch data protection authority, announced a fine of €824,990,000 against Uber on a decision dated August 17, finding that between 2018 and 2022 software tracking driving behaviour and customer reviews had deactivated drivers' accounts — temporarily on suspicion of fraud or low ratings, permanently where low ratings persisted — with no human assessment, and that Uber had not sufficiently informed drivers that the decisions were automated. Uber has stopped the conduct and has appealed (Source: autoriteitpersoonsgegevens.nl). GDPR penalties are capped at 4% of worldwide annual turnover, a ceiling with no counterpart in the CCPA framework, where the ADMT obligations carry the CCPA's per-violation penalty structure instead.
Relationships
- depends-on: AI and Privacy — ADMT is a privacy-law construct.
- related: Algorithmic Accountability and Bias Audits — overlapping accountability goals.
- related: Meaningful Human Review — human-oversight standard for automated decisions.
- related: AI Federalism — part of state-level AI regulation.
- related: California CCPA/CPRA Regulations — Automated Decision-Making Technology (ADMT) — regulations defining ADMT and its obligations.
- related: General Data Protection Regulation (GDPR) — Article 22 states the EU prohibition on solely automated decisions with legal or similarly significant effects.
- related: Autoriteit Persoonsgegevens — Dutch supervisory authority behind the largest Article 22 enforcement action to date.