California Privacy Protection Agency — Automated Decisionmaking Technology (ADMT) Regulations
CA · 11 Cal. Code Regs. §§ 7200-7232
California's privacy agency finalized binding regulations governing automated decision-making and AI used to make significant decisions about Californians — including hiring, housing, education, healthcare, financial services, and ads to minors. Consumers gain rights to pre-use notice, opt-out, and access to information about how AI made the decision.
Technical detail
California Privacy Protection Agency Regulations, 11 Cal. Code Regs. §§ 7200-7232 (ADMT regulations adopted Nov. 21, 2025; effective Apr. 1, 2026 with phased compliance through Jan. 2027). Implements California Privacy Rights Act (Cal. Civ. Code § 1798.185(a)(15)-(16)). Covers ADMT for 'significant decisions' (employment, housing, education, healthcare, financial services), extensive profiling (workplace surveillance), and training of ADMT/AI.
Who is protected: California consumers, employees, students, and applicants subjected to automated decision-making
Who must comply: Businesses subject to CCPA/CPRA using ADMT for significant decisions, extensive profiling, or model training
Key facts
| Jurisdiction | CA |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Stronger protection |
| Effective date | 2026-01-01 |
| Enacted | 2025-11-21 |
| Citation | 11 Cal. Code Regs. §§ 7200-7232 |
| Enforced by | California Privacy Protection Agency; California Attorney General |
| Private right of action | No — agency enforcement only |
| Penalties | Administrative fines up to $2,500 per violation ($7,500 if intentional or involving minors) under Cal. Civ. Code § 1798.155 |
| Topics | consumer data privacy · automated decision-making · consumer protection · AI disclosure and transparency · AI hiring and employment |
| Last verified | 2026-06-17 |
| Official source | CPPA — Final ADMT, Risk Assessment, Cybersecurity Audit, and Insurance Regulations (Nov. 2025) ↗ |
More AI rules in CA
- CA AB 2148 no-AI school employees (2026) · Enacted (not yet in effect)
- CA AG Bonta · In effect
- CA Bar GenAI Guidance · In effect
- CA SB 1120 (AI prior auth) · In effect
- CA AB 2655 (deepfake takedown) · Blocked / in litigation
- CPPA Honda ADMT settlement · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.