Guide for AI Incorporation under the CCPA

Within the last few years, companies have fervently implemented Artificial Intelligence into their business, seeking the benefits to efficiency the technology can bring. Before installing such programs, it is important to limit legal exposure to violations of the California Consumer Privacy Act (CCPA).

On January 01, 2026, the California Privacy Protection Agency (CPPA)’s updated regulations regarding AI became effective. The CPPA regulated Automated Decision-making Technology (ADMT), defined as technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making. This broad definition can be argued to include both generative and agentic AI depending on the use of AI as discussed below. The following guide is used to help determine whether a company is subject to this regulation and how to conform to its policies.

1. Is the Company governed by the CCPA?

Regulated companies do business in California AND one of the following:

1. The business has a total annual revenue of more than $25 million,
2. The business buys, sells, or shares personal information of 50,000 or more CA consumers annually
3. Derives 50% or more of annual revenue from selling California resident personal information.

2. Is the AI Use governed by the CCPA?

1. ADMT use is in the following services: I) Financial or Lending services, II) Housing, III) Education enrollment, IV) Employment, and V) Healthcare Servies.
2. The ADMT use involves the following: The technology processes personal information such as and makes a decision without human involvement.

Exclusions:

1. Human involvement interpreting the technology’s output with independent authority to make the decision
2. ADMT used for Advertisement
3. ADMT used for Web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam/robocall filtering, spellchecking calculators, databases, and spreadsheets
4. ADMT used for cybersecurity incidents, fraud, or illegal acts

3. Requirements under CCPA

1. Pre-use Notice

Businesses using ADMT as governed within section 2 must provide a notice to consumers of the business’ use of ADMT and consumers’ rights to opt out and access ADMT. This notice must be specific to the actual use and describe how the consumer can access the opt-out and right to access functions

Businesses are not required to provide a pre-use notice for ADMT used for the investigations, detection, or prevention of cybersecurity incidents, fraud, or illegal acts.

2. Right to Opt Out

Businesses are required to provide either i) the ability to opt-out of the use of ADMT or ii) a method to appeal a decision made by ADMT to a human reviewer with authority to overturn the decision. Opt-out links must be accessible through at minimum an interactive form accessible in the pre-use notice.

Businesses are not required to provide an opt-out link if ADMT is used for a) the indiscriminate assessment of an applicant’s ability to perform at work or educational program, b) the indiscriminate allocation of work assignments

3. Right to Access

When responding to consumer’s right to request access the business must provide explanations to the following information

1. The specific purposes ADMT is used and not merely generic terms such as improvement
2. How ADMT processes personal information to generate output
3. How the generated output makes a decision affecting the consumer
4. The business is prohibited from retaliation against consumers from exercising CCPA rights and instructions regarding exercise.

Conclusion:

Compliance with these requirements must take effect by January 1, 2027. Violations have consistently been investigated and pursued by state authorities. It is important to review company policies before implementing these technologies within company systems to avoid state inquiries and violations.