# Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal

- **Record type**: Obligation
- **Instrument**: California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
- **Jurisdiction**: California (United States)
- **Category**: human_oversight
- **Binding**: Yes
- **Applies from**: 2027-01-01
- **Provision**: Cal. Code Regs. tit. 11, § 7221

## In brief

Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal is a legal requirement under the California CPPA automated decision-making rules in California (United States) (Cal. Code Regs. tit. 11, § 7221). It applies from 1 January 2027. The record carries 3 evidence examples.

## What the duty requires

Consumers must be able to opt out of the use of ADMT for a significant decision, through at least two designated methods that are easy to use and need minimal steps; a business that deals with consumers online must offer an interactive form linked from the Pre-use Notice, and a cookie banner is not enough. A verifiable request may not be required. If the consumer opts out before processing starts, the ADMT must not be used for them; if after, processing must stop within 15 business days and service providers and contractors must be told. The business must wait 12 months before asking the consumer to consent again. Exceptions include offering an appeal to a human reviewer with authority to overturn the decision, and certain admission, acceptance, hiring and work-allocation uses that meet the stated conditions.

## What an organisation does about it

Build the opt-out form and a second method, wire opt-outs to stop processing within 15 business days and to notify vendors, or document the exception relied on and, for the human-appeal exception, designate and train reviewers who can overturn the decision.

## Controls that meet this duty

- Decision explanation, human review and appeal route (supports): https://aipolicytracker.org/controls/decision-explanation-and-appeal-route
- Human oversight design and override procedure (supports): https://aipolicytracker.org/controls/human-oversight-and-override
- Privacy and data-protection controls for AI (supports): https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai

## Parent instrument

- California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
  - Record: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations
  - Context file: https://aipolicytracker.org/policies/us-california-cppa-admt-regulations.md

## Provenance

- **Permanent id**: AIPT-OBL-0119 (https://aipolicytracker.org/id/AIPT-OBL-0119; never changes or gets reused)
- **Record page**: https://aipolicytracker.org/obligations/us-california-ccpa-admt-opt-out
- **Official source**: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- **Provision**: Cal. Code Regs. tit. 11, § 7221
- **Review status**: pending review
- **Confidence**: high
- **Facts last confirmed**: never confirmed against the official source
- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/
- **Cite as**: AIPolicyTracker (2026). "Let consumers opt out of automated decision-making technology for significant decisions, or offer a qualifying human appeal (California CPPA automated decision-making rules)" [AIPT-OBL-0119, not yet verified]. https://aipolicytracker.org/id/AIPT-OBL-0119 (accessed 12 November 2026).

> This record is a structured summary with a link to the official text. It is not legal advice. Open the official source before relying on any date or duty. How current each record type must be is published at https://aipolicytracker.org/verification; what a record must carry at all is published at https://aipolicytracker.org/coverage.