# Answer consumers' requests to access information about how automated decision-making technology was used about them

- **Record type**: Obligation
- **Instrument**: California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
- **Jurisdiction**: California (United States)
- **Category**: transparency
- **Binding**: Yes
- **Applies from**: 2027-01-01
- **Provision**: Cal. Code Regs. tit. 11, § 7222

## In brief

Answer consumers' requests to access information about how automated decision-making technology was used about them is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, § 7222). It applies from 1 January 2027. The record carries 2 evidence examples.

## What the duty requires

On a verified request, the business must explain in plain language the specific purpose for which it used ADMT about the consumer; the logic of the ADMT, enough for the consumer to understand how their information produced the output; the outcome and how the output was used in the decision, including any human's role; and that retaliation is prohibited, with how to exercise other CCPA rights. Trade secrets and certain security information may be withheld. Where ADMT was used about the consumer more than four times in 12 months, an aggregate-level response is allowed. Service providers and contractors must help.

## What an organisation does about it

Prepare a response template per system covering purpose, logic, outcome and human role, route access requests through the existing request-to-know process, and require vendors by contract to supply what the response needs.

## Controls that meet this duty

- Decision explanation, human review and appeal route (satisfies): https://aipolicytracker.org/controls/decision-explanation-and-appeal-route
- Contractual allocation of AI duties across the supply chain (supports): https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties

## Parent instrument

- California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
  - Record: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations
  - Context file: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations.md

## Provenance

- **Permanent id**: AIPT-OBL-0120 (https://aipolicytracker.org/id/AIPT-OBL-0120; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-california-ccpa-admt-access
- **Official source**: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- **Provision**: Cal. Code Regs. tit. 11, § 7222
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Answer consumers' requests to access information about how automated decision-making technology was used about them (California CPPA automated decision-making rules)" [AIPT-OBL-0120, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0120 (accessed 12 November 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.