California CCPA Regulations (Title 11, Division 6)

The California CCPA Regulations (California Code of Regulations, Title 11, Division 6, Chapter 1) are the implementing regulations for the California Consumer Privacy Act of 2018 (Civil Code § 1798.100 et seq.), issued by the California Privacy Protection Agency (CPPA) and running 127 pages in the captured text. The text is headed "CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations": alongside revisions to the general rules on notices, consumer requests, and service providers, it adds articles on annual cybersecurity audits, privacy risk assessments, automated decisionmaking technology (ADMT), and insurance companies. The ADMT, risk-assessment, and training provisions bear directly on AI governance, regulating automated processing through privacy law rather than through AI-specific statute.

Background

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is administered and enforced by the California Privacy Protection Agency, the body created for that purpose; the regulations define the "Agency" by reference to Civil Code § 1798.199.10 et seq. The regulations supplement the statutory definitions in Civil Code § 1798.140 and cite §§ 1798.175 and 1798.185 as authority. The file's metadata gives a 2024 publication date; the text itself leaves the effective date blank ("[OAL to fill in the effective date of these regulations]"), sets ADMT compliance from January 1, 2027, and schedules risk-assessment submissions and cybersecurity audits from 2028 to 2030. The captured text is a markup of the rulemaking: renumbered definitions appear with both old and new letters (for example "(f) (e)"), and struck and inserted wording sometimes appear side by side. Several sections it cross-references, such as §§ 7016, 7081 and 7101, are not reproduced in it.

Definitions relevant to AI

Section 7001 includes several definitions that structure the AI-related articles:

• Automated decisionmaking technology (ADMT): "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." Technology "substantially replaces" human decisionmaking when a business uses its output to decide without human involvement. Human involvement requires a reviewer who knows how to interpret and use the output, reviews and analyzes the output and other relevant information, and has authority to make or change the decision. ADMT includes profiling that replaces or substantially replaces human decisionmaking, and excludes web hosting, domain registration, networking, caching, data storage, firewalls, anti-virus and anti-malware, spam and robocall filtering, spellchecking, calculators, databases, and spreadsheets, provided they do not replace human decisionmaking.
• Significant decision: a decision resulting in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. The employment category covers hiring; allocation or assignment of work and compensation; promotion; and demotion, suspension, and termination. The education category covers admission, credentials, and suspension and expulsion. Advertising to a consumer is not a significant decision, nor is housing provided or denied solely on availability or receipt of payment.
• Profiling: automated processing of personal information to evaluate personal aspects such as intelligence, ability, aptitude, and predispositions, in particular to analyze or predict performance at work, economic situation, health (including mental health), personal preferences, interests, reliability, behavior, location, or movements.
• Physical or biological identification or profiling: identifying or profiling a consumer through automated measurement or analysis of physical or biological characteristics, including biometric information, vocal intonation, facial expression, and gesture, for example to identify or infer emotion.
• Train (for §§ 7150(b)(6) and 7153): the process by which a technology "discovers underlying patterns, learns a series of actions, or is taught to generate a desired output," including adjusting an ADMT algorithm's parameters, improving how a machine-learning model learns, and iterating the datasets fed into ADMT.
• Systematic observation: methodical and regular or continuous observation, including through Wi-Fi or Bluetooth tracking, RFID, drones, video or audio recording or live-streaming, biometric identification technologies, geofencing, location trackers, or license-plate recognition.
• Sensitive personal information includes neural data, defined as information generated by measuring the activity of a consumer's central or peripheral nervous system and not inferred from nonneural information, and personal information of consumers the business knows to be under 16.
• Other definitions include sensitive location (healthcare facilities, pharmacies, domestic violence shelters, food pantries, housing and emergency shelters, educational institutions, political party offices, legal services offices, union offices, and places of worship), performance at work, and performance in an educational program. Union membership or interest in unionizing, interest in other employment, off-duty location, and personal-account use are expressly excluded from "performance at work."

Purpose limitation and data minimization (§ 7002)

A business's collection, use, retention, and sharing of personal information must be "reasonably necessary and proportionate" to the purposes for which it was collected, which must be consistent with consumers' reasonable expectations, or to another disclosed purpose compatible with the context of collection. Reasonable expectations turn on the relationship with the business, the type and amount of information, its source and collection method, the clarity of disclosures, and how apparent the involvement of service providers or third parties is. Necessity and proportionality turn on the minimum personal information needed, possible negative impacts, and safeguards such as encryption or automatic deletion. Processing for any other purpose requires consent, which consumers may withdraw. Among its illustrations of compatibility, the regulation gives as an example of a weak link the use of information collected to provide a cloud storage service "to research and develop an unrelated facial recognition service." A business may not collect categories of information not disclosed in its Notice at Collection, and needs a new notice for incompatible new purposes.

The regulations also address data minimization and purpose limitation as they relate to AI development in other places: training ADMT or identification technology on consumers' personal information triggers a risk assessment (§ 7150(b)(6)); a service provider may use personal information to improve its own services but not to perform services for another person (§ 7050(a)(3)); and the security exception to the right to limit does not allow retaining employee biometric information indefinitely or using it "for unrelated purposes, such as the development of commercial products" (§ 7027(m)(3)(B)).

Consent, disclosures and dark patterns (§§ 7003–7004)

Disclosures must be easy to read, use plain language, be readable on small screens, be available in the languages the business ordinarily uses, and be accessible to consumers with disabilities, following standards such as the Web Content Accessibility Guidelines 2.1. Methods for submitting requests and obtaining consent must be easy to understand, offer symmetry in choice, avoid confusing language or interactive elements, avoid choice architecture that impairs choice, and be easy to execute. The regulation's examples of non-compliant designs include "Yes" and "Ask me later" as the only options; a banner offering only "Accept All" and "More Information"; a more prominent "yes" button; double negatives; closing a pop-up treated as consent; false countdown clocks; bundling consent to incompatible uses with necessary ones; and consent buried in general terms of use. A non-compliant method may be a dark pattern, and agreement obtained through dark patterns "shall not constitute consumer consent." A user interface is a dark pattern if it has "the effect of substantially subverting or impairing user autonomy, decisionmaking, or choice"; intent is a factor but not determinative.

Required disclosures (Article 2)

Businesses must provide a privacy policy, a Notice at Collection, and, where applicable, a Notice of Right to Opt-out of Sale/Sharing, a Notice of Right to Limit, and a Notice of Financial Incentive. A business that uses ADMT for significant decisions must also provide a Pre-use Notice with an opt-out link, subject to the § 7221(b) exceptions (§ 7010). The privacy policy must list, for the preceding 12 months, categories of personal information collected, sources, purposes, categories sold, shared, or disclosed and to whom, and whether the business knowingly sells or shares information of consumers under 16. It must explain the rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, opt out of ADMT, and access ADMT, and the right not to be retaliated against, including for job applicants, students, employees, and independent contractors (§ 7011). The Notice at Collection must list categories of information, purposes, whether each is sold or shared, and retention periods, and may not be skipped: without it, the business may not collect personal information (§ 7012). The "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or a single Alternative Opt-out Link titled "Your Privacy Choices" or "Your California Privacy Choices," must appear in the homepage header or footer; notices for connected devices and augmented or virtual reality must reach the consumer before or when collection begins (§§ 7013–7015).

Consumer requests (Article 3)

• Methods and timing. Businesses other than online-only businesses with a direct relationship must offer two or more methods for requests to delete, correct, or know, including a toll-free number (§ 7020). Receipt of requests to delete, correct, know, access ADMT, or appeal ADMT must be confirmed within 10 business days, and a response given within 45 calendar days, extendable once by 45 days to a maximum of 90 with notice (§ 7021).
• Deletion and correction. Deletion requires erasure, deidentification, or aggregation and notice to service providers, contractors, and third parties, with any claim of impossibility or disproportionate effort explained in detail (§ 7022). A business may deny a correction request if the information is more likely than not accurate on the totality of the circumstances; a consumer whose health-information correction is denied may add a statement of up to 250 words per alleged inaccuracy; and a business must ensure corrected information is not overwritten by later data-broker updates (§ 7023).
• Requests to know. Responses cover the preceding 12 months and, on request, information collected on or after January 1, 2022, unless impossible or disproportionate; sensitive identifiers such as Social Security numbers, account passwords, and unique biometric data are not disclosed (§ 7024).
• Opt-out preference signals. A business that sells or shares personal information must treat a signal in a commonly used format (such as an HTTP header field or JavaScript object) as a valid request to opt out of sale or sharing for that browser or device and any associated profile, including pseudonymous profiles, and for the consumer if known. It must display whether it has processed the signal. Processing a signal "in a frictionless manner" (no fee, no change in experience, no pop-up) allows a business to omit the opt-out links; posting the links does not relieve a business of honoring signals (§ 7025).
• Opt-out of sale/sharing and right to limit. Opt-outs must be honored within 15 business days and forwarded to third parties; a cookie banner alone is not an acceptable opt-out method; verification may not be required; and a business must wait 12 months before asking the consumer to opt back in (§§ 7026–7027). Section 7027(m) lists the purposes for which sensitive information may be used without offering a right to limit, including providing expected services, security, fraud prevention, physical safety, short-term transient use, quality and safety of the business's product, and processing not for the purpose of inferring characteristics. Opting back in requires a two-step process (§ 7028).

Service providers, verification, minors and non-discrimination (Articles 4–7)

A service provider or contractor may retain, use, or disclose personal information only for the contracted business purposes and certain listed purposes, including internal use "to build or improve the quality of the services it is providing to the business" so long as it does not use the information to perform services for another person; it cannot contract to provide cross-context behavioral advertising (§ 7050). Service providers must cooperate with the business's cybersecurity audits and risk assessments, and contracts may require assistance with ADMT compliance (§§ 7050(h), 7051). Contracts must specify business purposes in specific rather than generic terms, and a business's lack of due diligence can defeat a defense that it had no reason to believe a vendor was violating the law (§§ 7051, 7053).

Businesses may not require identity verification for requests to opt out of sale or sharing, to limit, or to opt out of ADMT. Requests to know specific pieces of information and requests to access ADMT require verification to a "reasonably high degree of certainty," which may involve matching three pieces of personal information plus a signed declaration under penalty of perjury (§§ 7060, 7062). Businesses selling or sharing information of children under 13 must verify parental consent by methods such as signed forms, payment-card transactions, trained-staff calls or video, or government-ID checks (§ 7070). A price or service difference is discriminatory if it treats a consumer differently for exercising CCPA rights, unless reasonably related to the value of the consumer's data (§ 7080).

Large data holders (§ 7102)

A business that buys, receives, sells, shares, or makes available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year must compile annual metrics on requests to delete, correct, know, access ADMT, opt out of sale or sharing, limit, and opt out of ADMT (received, complied with, and denied), plus the median or mean response time, and disclose them by July 1 each year.

Cybersecurity audits (Article 9)

A business must complete an annual cybersecurity audit if its processing presents "significant risk to consumers' security": if it meets the Civil Code § 1798.140(d)(1)(C) threshold, or meets the (d)(1)(A) threshold and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding year (§ 7120). First audit reports are due April 1, 2028 for businesses with 2026 revenue above $100,000,000; April 1, 2029 for revenue between $50,000,000 and $100,000,000; and April 1, 2030 for revenue under $50,000,000, with annual audits thereafter (§ 7121).

Audits must be performed by a qualified, objective, independent auditor, internal or external, using accepted professional standards such as those of the AICPA, PCAOB, ISACA, or ISO; findings may not rely primarily on management assertions, and records must be kept for five years (§ 7122). The audit must assess the business's cybersecurity program and, where applicable, 18 listed components, including phishing-resistant multi-factor authentication, encryption at rest and in transit, least-privilege access controls, data and system inventories, secure configuration and patch management, vulnerability scanning and penetration testing, audit logs, network monitoring and data-loss prevention, segmentation, training, secure coding, vendor oversight, retention and disposal, incident response, and business continuity. An audit prepared for another purpose, such as one using the NIST Cybersecurity Framework 2.0, may be used if it meets the requirements (§ 7123). A member of executive management must certify completion to the Agency annually under penalty of perjury (§ 7124).

Risk assessments (Article 10)

A business must conduct a risk assessment before initiating processing that presents "significant risk to consumers' privacy" (§ 7150), defined as:

1. Selling or sharing personal information.
2. Processing sensitive personal information (with a narrow exemption for employee data used for payroll, employment authorization, benefits, accommodations, and wage reporting).
3. Using ADMT for a significant decision concerning a consumer.
4. Using automated processing to infer or extrapolate a consumer's intelligence, ability, aptitude, performance at work, economic situation, health, preferences, reliability, behavior, location, or movements based on systematic observation of the consumer as an educational program applicant, job applicant, student, employee, or independent contractor.
5. Using automated processing to make such inferences based on the consumer's presence in a sensitive location.
6. Processing personal information the business intends to use to train ADMT for a significant decision, or to train facial-recognition, emotion-recognition, or other technology that verifies identity or conducts physical or biological identification or profiling. "Intends to use" includes permitting others to use, and advertising or marketing the use.

The regulation's examples include an employer that plans to videotape job interviews and use emotion-recognition technology without human involvement to decide whom to hire, and a technology provider that plans to extract faceprints from consumers' photographs to train its facial-recognition technology; both must conduct risk assessments.

The assessment must determine "whether the risks to consumers' privacy from the processing of personal information outweigh the benefits" to the consumer, the business, other stakeholders, and the public (§ 7152). The report must document a specific (not generic) purpose; the categories and minimum necessary personal information; operational details including retention, number of consumers, disclosures, and recipients; for ADMT used for significant decisions, "the logic of the ADMT, including any assumptions or limitations of the logic" and how its output will be used; benefits; negative impacts, such as discrimination on protected characteristics and economic, physical, reputational, and psychological harms; safeguards, such as privacy-enhancing technologies (trusted execution environments, federated learning, homomorphic encryption, differential privacy) and policies to ensure ADMT "works for the business's purpose and does not unlawfully discriminate"; whether the processing will proceed; and who contributed and approved. Relevant employees must take part, and external parties such as experts in detecting and mitigating bias in ADMT or consumer advocacy organizations may (§ 7151). A business that makes ADMT trained on personal information available to another business for significant decisions must give that business the facts it needs for its own risk assessment (§ 7153). The stated goal is "restricting or prohibiting the processing of personal information if the risks to privacy of the consumer outweigh the benefits" (§ 7154).

Assessments must be reviewed at least every three years and updated within 45 calendar days of a material change; processing already under way when the regulations take effect must be assessed by December 31, 2027; and assessments must be retained for the duration of processing or five years, whichever is later. A single assessment may cover comparable processing activities, and an assessment prepared under another state's law may be used if supplemented (§§ 7155–7156). Businesses submit summary information and an executive attestation under penalty of perjury to the Agency: by April 1, 2028 for assessments conducted in 2026 and 2027, and by April 1 of the following year thereafter. The Agency or the Attorney General may demand full reports at any time, to be produced within 30 calendar days (§ 7157).

Automated decisionmaking technology (Article 11)

The ADMT article applies to a business that uses ADMT to make a significant decision concerning a consumer. Businesses already using ADMT for significant decisions before January 1, 2027 must comply by that date; later users must comply whenever they use it (§ 7200).

Pre-use notice (§ 7220). Before collecting personal information to be processed with ADMT, or before repurposing previously collected information for that use, the business must give a prominent Pre-use Notice in the manner it primarily interacts with the consumer. The notice must give a plain-language explanation of the specific purpose (not merely "to make a significant decision"); describe the right to opt out of ADMT and how to exercise it, or, where an exception applies, the right to appeal or the specific exception relied on; describe the right to access ADMT; state that retaliation is prohibited; and explain how the ADMT processes personal information, including the categories that affect its output, what type of output it generates and how that output is used (including whether it is the sole factor and any human's role), and the alternative process for consumers who opt out. Trade secrets and information that would compromise security, fraud prevention, or physical safety need not be disclosed. Consolidated notices may cover one ADMT used for several purposes, several ADMTs used for one purpose (the example given is resume screening together with analysis of applicants' "vocal intonation, facial expression, and gestures"), or the systematic use of one ADMT.

Right to opt out (§ 7221). Businesses must allow consumers to opt out of ADMT for significant decisions, except where:

• the business offers an appeal to a human reviewer who can interpret the ADMT output, considers the consumer's information, and has authority to overturn the decision;
• for admission, acceptance, or hiring decisions, the ADMT is used solely to assess the consumer's ability to perform at work or in an educational program, and it "works for the business's purpose and does not unlawfully discriminate based upon protected characteristics"; or
• for allocation or assignment of work and compensation, the ADMT is used solely for that purpose and meets the same non-discrimination condition.

At least two opt-out methods are required, including an online form linked from the Pre-use Notice for businesses that interact online (titled, for example, "Opt-out of Automated Decisionmaking Technology"); a cookie banner is not an acceptable method. Opt-outs may not require an account or verification. If a consumer opts out before processing begins, the business may not start; if later, it must stop within 15 business days and instruct its service providers to do the same. A business must offer a single option to opt out of all its ADMT uses, and must wait 12 months before asking an opted-out consumer to consent again.

Right to access (§ 7222). On a verified request, a business must explain in plain language the specific purpose for which it used ADMT for the consumer; "information about the logic of the ADMT" sufficient for the consumer to understand how it processed their information, which may include the parameters that generated the output and the specific output; and the outcome, including how the output was used and any other factors or human role, and how the output will be used in future significant decisions. Trade secrets and security-sensitive information may be withheld. A business that used ADMT for a consumer more than four times in 12 months may give an aggregate response summarizing outputs and the parameters that on average affected them. Businesses may add information such as the five most common outputs and the share of consumers receiving each during the preceding calendar year. Requests to access and appeal ADMT follow the general 10-business-day confirmation and 45-day response timeline (§ 7021).

Insurance companies and enforcement (Articles 12–13)

Insurance companies subject to the Insurance Code must comply with the CCPA for personal information not subject to the Insurance Code, such as website browsing data used for personalized advertising or employee and job-applicant information, but not for information collected in connection with an insurance transaction such as a claim (§§ 7270–7271). Sworn complaints are filed with the Agency's Enforcement Division, which must notify complainants of any action taken (§ 7300). Probable cause proceedings under Civil Code § 1798.199.50 are closed to the public unless the alleged violator requests otherwise at least 10 business days in advance, and the Agency's probable cause determination is final and not subject to appeal (§ 7302).

Key AI-relevant provisions

The regulations define ADMT and establish consumer rights around automated processing used for significant decisions in lending, housing, education, employment, and healthcare. These include a right to opt out of automated decisionmaking, subject to human-appeal and narrow employment and admissions exceptions; a right to access information about the logic involved in automated decisions; pre-use notice requirements for ADMT that processes personal information; and risk assessments for ADMT processing and for training ADMT or biometric identification technology on personal information. They also constrain how personal data can be used for AI training, limit the secondary use of consumer data for model development, and impose transparency requirements on data practices, through the purpose-limitation, risk-assessment, and service-provider provisions described above.

Relation to other AI governance approaches

The ADMT provisions operate as a privacy-based approach to AI governance, running in parallel with the safety-based approach of SB 53 and the anti-discrimination approach of the Colorado AI Act. The US Regulatory Approaches Compared page treats the CCPA/CPRA framework as a distinct, privacy-based regulatory approach that governs AI through the lens of personal data processing, alongside safety, discrimination, liability, and preemption approaches.

The ADMT provisions resemble the transparency and human oversight requirements that the EU AI Act applies to high-risk systems, but reach those outcomes through privacy law rather than AI-specific regulation. California Attorney General guidance, summarized in State AG AI Guidances, cites the CCPA as one of the existing laws already governing AI. The regulations are also an instance of state-level rulemaking filling a federal gap, a pattern discussed in Techno-Federalism.

Relationships

• related: California CCPA/CPRA Regulations — Automated Decision-Making Technology (ADMT) — legislation-tracker page for the ADMT regulations.
• related: Automated Decision-Making Technology (ADMT) — the regulatory term these rules define.
• related: California Privacy Protection Agency (CPPA) — issuing and enforcing agency.
• related: AI and Privacy
• related: SB 53 — parallel safety-based California approach.
• related: Colorado AI Act — anti-discrimination approach to consequential automated decisions.
• related: EU AI Act — comparable transparency and human-oversight requirements for high-risk systems.
• related: US Regulatory Approaches Compared
• related: State AG AI Guidances
• instance-of: Techno-Federalism

Provenance

Source: California Privacy Protection Agency (CPPA), 2024 per the file metadata; 127 pages of implementing regulations headed "CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations," from cppa.ca.gov. The PDF was converted to markdown on 2026-04-13; the conversion flattened the rulemaking markup, so struck and added text are not distinguished. Confidence is medium: the page summarizes a single primary text.