California AI compliance: CCPA, ADMT, and AB 2930
CCPA Automated Decision-Making Technology regulations
The California Privacy Protection Agency (CPPA) is finalizing regulations under the CCPA that address Automated Decision-Making Technology (ADMT). These regulations require businesses to provide pre-use notices before using ADMT in significant decisions, offer opt-out rights for certain ADMT uses, and conduct risk assessments for high-risk processing. The regulations are anticipated to take effect on or around January 1, 2027.
AB 2930 — Automated Decisions in Employment and Housing
AB 2930 would require employers, contractors, and housing providers using automated decision systems to conduct impact assessments, notify affected individuals, and provide accommodation and appeal rights. The bill addresses AI systems used in hiring, compensation, performance evaluation, promotion, termination, and housing decisions affecting California residents.
Pre-use notices and opt-out rights
Under the CPPA's proposed ADMT framework, businesses must provide notice before using automated decision-making in ways that significantly affect consumers — including decisions about employment, credit, insurance, and housing. Consumers have the right to opt out of certain ADMT uses and to request human review of ADMT-driven decisions.
Enforcement: CCPA civil penalties and private right of action
CCPA violations carry civil penalties of $2,500 per unintentional violation and $7,500 per intentional violation. For data breaches involving personal information, California provides a private right of action allowing affected individuals to seek $100–$750 per consumer per incident. The CPPA has dedicated enforcement capacity and has demonstrated willingness to pursue investigations.