{"id":72891,"date":"2025-09-25T11:31:01","date_gmt":"2025-09-25T15:31:01","guid":{"rendered":"https:\/\/statescoop.com\/?p=72891"},"modified":"2025-09-25T11:31:03","modified_gmt":"2025-09-25T15:31:03","slug":"california-automated-decision-making-tools","status":"publish","type":"post","link":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","title":{"rendered":"California approves new privacy rules for automated decision-making software"},"content":{"rendered":"\n

California’s Privacy Protection Agency on Tuesday announced<\/a> it had received final approval from the California Office of Administrative Law on regulations regarding cybersecurity audits, risk assessments and automated decision-making tools, ending a yearslong process of feedback and markups.<\/p>\n\n\n\n

The new regulations, which have drawn mixed reactions, were approved by the CPPA board in July and submitted to the law office for formal acceptance, which they needed before they could take effect next year. The regulations will go into effect Jan. 1, but there is additional time for businesses to comply with some of the new requirements, which include cybersecurity audits and risk assessments.<\/p>\n\n\n\n

The regulations arrive after more than a year of drafting, revisions<\/a>, public comments and debates to explore guardrails for the technology, which kicked off in 2021 as part of the CPPA’s work to understand emerging artificial intelligence technologies and how they interact with\u00a02018\u2019s\u00a0California Consumer Protection Act<\/a>, the standard-setting consumer data privacy law that set off a tidal wave of state-level, comprehensive data-privacy legislation.<\/p>\n\n\n\n

Many, including Gov. Gavin Newsom<\/a> and industry interest groups, offered their opinions throughout the process, urging the CPPA board not to overly regulate the burgeoning AI market, which resulted in any references to “artificial intelligence” being scrubbed<\/a> from the regulations.<\/p>\n\n\n\n

As a result, the CPPA’s new rules broadly define automated decision-making tools as those that replace human decision-making for “significant decisions” in areas like lending, housing, employment, education, independent contracting opportunities and health care. Businesses covered by CCPA must also provide consumers with clear notices about how automated tools are used, including the logic involved, the potential risks and information about individuals\u2019 rights.<\/p>\n\n\n\n

The notices must also be presented to consumers at or before the point of data collection, and, most notably, businesses are required to offer consumers two “opt out” methods. These regulations go into effect Jan. 1, 2027.<\/p>\n\n\n\n

The new regulations also require businesses to conduct and document regular risk assessments when engaging in any activity that could present a risk to consumers\u2019 privacy or security, especially when they use automated decision-making tools, or sell, share or process consumers’ personal information. The risk assessments also must “identify and document” which types of personal information the tools will process, and they must be reviewed and updated at least once every three years. Businesses must submit risk assessment attestations to the CCPA by April 1, 2028, but compliance begins next Jan. 1.<\/p>\n\n\n\n

Similarly, businesses that process personal information will also now be required to conduct annual cybersecurity audits. In most cases, the audits must be conducted by \u201cqualified, objective, independent\u201d professional auditors. Audits that are conducted for other purposes \u2014 such as ensuring compliance with the National Institute of Standards and Technology’s Cybersecurity Framework \u2014 can be used to fulfill the CCPA’s audit requirement.<\/p>\n\n\n\n

The regulations offer leeway for businesses that make less than $100 million but more than $50 million \u2014 they’ll be given until 2029 to comply. Those that make less than $50 million have until 2030. Businesses grossing more than $100 million in 2026 must complete audits for 2027 by April 1, 2028, but all businesses meeting the general audit applicability requirements will have to complete audits for 2029 by April 1, 2030.<\/p>\n\n\n\n

The new rules have been met with mixed reactions. Cobun Zweifel-Keegan, managing director of IAPP, a data-privacy nonprofit, said they offer much-needed clarity.<\/p>\n\n\n\n

The CCPA also has broader implications, as California’s privacy rule-making tends to influence other states’ consumer privacy laws.<\/p>\n\n\n\n

\u201cWith substantial updates across a wide range of California\u2019s privacy law, the final regulations have important implications for many companies,” Zweifel-Keegan wrote in an emailed statement. “The rules add clarity to some important questions, like how the application of California\u2019s privacy law to employees should be considered. There will be operational impacts beyond the major updates, but those big pieces like cybersecurity audits and automated decision making systems should be a top priority for privacy teams to review and verify compliance before the rules go into effect on January 1.\u201d<\/p>\n\n\n\n

Kristian Stout, director of innovation policy at the\u00a0International Center for Law and Economics<\/a>, a nonprofit research group, said the new rules are overly broad and that their definitions could stifle innovation, particularly for small and medium-sized businesses.<\/p>\n\n\n\n

“While the CPPA was reasonable in its interest in looking at these rules in light of new technologies, the core framework remains rigid and risks placing California at a competitive disadvantage in AI leadership,” Stout wrote in an emailed statement. “The compliance burdens, particularly the phased cybersecurity audits and risk assessments, are a substantial cost for businesses of all sizes, and the impact on small businesses and the digital advertising ecosystem remains a valid concern. The CPPA\u2019s rules further divide a fractured regulatory landscape, forcing businesses to navigate complex and potentially contradictory obligations.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.<\/p>\n","protected":false},"author":133,"featured_media":72905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[25762],"tags":[4,12,29,251,5240,5275,25486,25863,25864,25865],"people":[],"special-report":[],"authors":[23807],"class_list":["post-72891","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-privacy","tag-tech-news","tag-state-local-news","tag-states","tag-privacy","tag-california-consumer-privacy-act","tag-data-analytics","tag-automated-decision-making-systems","tag-ccpa","tag-california-privacy-protection-agency","tag-consumer-privacy","author-kquinlan"],"yoast_head":"\nCalifornia approves new privacy rules for automated decision-making software | StateScoop<\/title>\n<meta name=\"description\" content=\"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"California approves new privacy rules for automated decision-making software | StateScoop\" \/>\n<meta property=\"og:description\" content=\"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-25T15:31:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-25T15:31:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1300\" \/>\n\t<meta property=\"og:image:height\" content=\"731\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Keely Quinlan\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/\",\"url\":\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/\",\"name\":\"California approves new privacy rules for automated decision-making software | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg\",\"datePublished\":\"2025-09-25T15:31:01+00:00\",\"dateModified\":\"2025-09-25T15:31:03+00:00\",\"description\":\"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg\",\"width\":1300,\"height\":731,\"caption\":\"(Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"California approves new privacy rules for automated decision-making software | StateScoop","description":"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","og_locale":"en_US","og_type":"article","og_title":"California approves new privacy rules for automated decision-making software | StateScoop","og_description":"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.","og_url":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2025-09-25T15:31:01+00:00","article_modified_time":"2025-09-25T15:31:03+00:00","og_image":[{"width":1300,"height":731,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg","type":"image\/jpeg"}],"author":"Keely Quinlan","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","url":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","name":"California approves new privacy rules for automated decision-making software | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg","datePublished":"2025-09-25T15:31:01+00:00","dateModified":"2025-09-25T15:31:03+00:00","description":"New rules governing the use of automated decision-making software arrive after more than a year of drafting and debate.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/california-automated-decision-making-tools\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg","width":1300,"height":731,"caption":"(Getty Images)"},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/california-automated-decision-making-tools\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"California approves new privacy rules for automated decision-making software","url":"http:\/\/statescoop.com\/california-automated-decision-making-tools\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/california-automated-decision-making-tools\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg"},"articleSection":"Privacy","author":[{"@type":"Person","name":"Keely Quinlan","url":"https:\/\/statescoop.com\/author\/kquinlan\/"}],"creator":["Keely Quinlan"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["automated decision-making systems","california consumer privacy act","california privacy protection agency","ccpa","consumer privacy","data analytics","privacy","state & local news","states","tech news"],"dateCreated":"2025-09-25T15:31:01Z","datePublished":"2025-09-25T15:31:01Z","dateModified":"2025-09-25T15:31:03Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"California approves new privacy rules for automated decision-making software\",\"url\":\"http:\\\/\\\/statescoop.com\\\/california-automated-decision-making-tools\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/california-automated-decision-making-tools\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/GettyImages-2149260007.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/09\\\/GettyImages-2149260007.jpg\"},\"articleSection\":\"Privacy\",\"author\":[{\"@type\":\"Person\",\"name\":\"Keely Quinlan\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/kquinlan\\\/\"}],\"creator\":[\"Keely Quinlan\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"automated decision-making systems\",\"california consumer privacy act\",\"california privacy protection agency\",\"ccpa\",\"consumer privacy\",\"data analytics\",\"privacy\",\"state & local news\",\"states\",\"tech news\"],\"dateCreated\":\"2025-09-25T15:31:01Z\",\"datePublished\":\"2025-09-25T15:31:01Z\",\"dateModified\":\"2025-09-25T15:31:03Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/09\/GettyImages-2149260007.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/72891","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/133"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=72891"}],"version-history":[{"count":10,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/72891\/revisions"}],"predecessor-version":[{"id":72909,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/72891\/revisions\/72909"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/72905"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=72891"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=72891"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=72891"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=72891"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=72891"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=72891"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}