California CPPA automated decision-making rules: requirements, deadlines and compliance actions
California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits
What this label means
- Verified
- — a named reviewer opened the official source and confirmed the record; the date and the reviewer are shown.
- Pending review
- — linked to the official source and in the queue for a reviewer to confirm.
- Source-linked
- — linked to the official source, not yet confirmed by a reviewer.
On this page 7 sections
In brief
The California CPPA automated decision-making rules is a binding regulation of California (United States), issued by California Privacy Protection Agency. It has been in force since 1 January 2026; its first obligations apply from 1 January 2027. Businesses subject to the CCPA that use automated decision-making technology for significant decisions, or whose processing requires a risk assessment or cybersecurity audit.
- Jurisdiction
- California (United States)
- Instrument type
- Regulation
- Status
- In force
- Legal force
- Binding
- Issuing body
- California Privacy Protection Agency
- Adopted
- 22 September 2025
- In force
- 1 January 2026
- Applies from
- 1 January 2027
- Verification
- Pending review · source-linked, checked 15 Oct 2026
What is the California CPPA automated decision-making rules?
Regulations under the California Consumer Privacy Act on automated decision-making technology (ADMT), risk assessments and cybersecurity audits. Businesses that use ADMT to make significant decisions about consumers must comply from 1 January 2027, with further deadlines phased into 2028.
Status note: Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it.
Who does it apply to?
Businesses subject to the CCPA that use automated decision-making technology for significant decisions, or whose processing requires a risk assessment or cybersecurity audit.
Businesses subject to the California Consumer Privacy Act.
- Risk categories
- High-risk
- AI system types
- Automated decision-making system
When do the requirements apply?
Approved by the Office of Administrative Law 22 September 2025; effective 1 January 2026; ADMT compliance from 1 January 2027; a submission to the CPPA due 1 April 2028.
Dates as stated in search extracts of the official source; confirm against it.
Official sources
-
CPPA announcement: regulations approved by the Office of Administrative Law
California Privacy Protection Agency · 23 Sep 2025 · Tier 1 source
-
CCPA updates, cybersecurity audits, risk assessments and ADMT regulations
California Privacy Protection Agency · Tier 1 source
Cite this record
AIPolicyTracker (2026). “California CPPA automated decision-making rules” [AIPT-POL-0208, record version 1, not yet verified]. https://aipolicytracker.org/id/AIPT-POL-0208 (accessed 21 October 2026). Data licensed CC BY 4.0.
Permanent id AIPT-POL-0208: it never changes or gets reused, and its address keeps working if this page moves.
Cite the official text alongside it: CPPA announcement: regulations approved by the Office of Administrative Law, California Privacy Protection Agency, https://cppa.ca.gov/announcements/2025/20250923.html.
BibTeX
@misc{aipolicytracker2026_californiacppaautomatedd,
author = {{AIPolicyTracker}},
title = {{California CPPA automated decision-making rules}},
year = {2026},
howpublished = {\url{https://aipolicytracker.org/policies/us-california-cppa-admt-regulations}},
url = {https://aipolicytracker.org/policies/us-california-cppa-admt-regulations},
urldate = {2026-10-21},
note = {Data licensed CC BY 4.0. Accessed 21 October 2026}
}
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
Change history
Record history
No change to this record's tracked fields has been recorded since 15 October 2026, when field-level history began.
Record version 1: Added in the October 2026 sub-national research round. Recorded on 15 October 2026 from search-engine extracts of the official pages listed; the official text could not be opened from the research environment, so every date and duty here is pending review against it. Every earlier wording is in the GitHub repository.
Frequently asked questions
Is the California CPPA automated decision-making rules in force?
Yes. The California CPPA automated decision-making rules is in force since 1 January 2026.
Is the California CPPA automated decision-making rules legally binding?
Yes. The California CPPA automated decision-making rules is a binding regulation; the obligations it creates are legal requirements for the actors it covers.
Who does the California CPPA automated decision-making rules apply to?
Businesses subject to the CCPA that use automated decision-making technology for significant decisions, or whose processing requires a risk assessment or cybersecurity audit.
When does the California CPPA automated decision-making rules apply?
Approved by the Office of Administrative Law 22 September 2025; effective 1 January 2026; ADMT compliance from 1 January 2027; a submission to the CPPA due 1 April 2028.
Where is the official text of the California CPPA automated decision-making rules?
The official text is published by California Privacy Protection Agency at https://cppa.ca.gov/announcements/2025/20250923.html (CPPA announcement: regulations approved by the Office of Administrative Law). This record links to it and is checked against it.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.