California ADMT Rules: What Triggers Disclosure

What ADMT means

"Automated Decisionmaking Technology" — any system that uses computation to make or assist a significant decision about a consumer. The CPPA's rules clarify the existing CCPA/CPRA opt-out and access rights as they apply to AI.

When the rules apply

The ADMT rules apply when a business uses ADMT to make a decision that produces a "significant effect" — defined to include:

• Financial or lending decisions
• Housing access or pricing
• Employment decisions (hiring, performance, discipline)
• Educational opportunities (admission, scholarships, grading)
• Healthcare access or pricing
• Insurance underwriting or pricing
• Access to essential goods and services

Three core consumer rights

• Pre-use notice: Before the ADMT processes their data, the consumer gets a clear notice
• Opt out: The consumer can request to opt out of ADMT for that decision (with limited exceptions)
• Access: The consumer can request information about the logic, the personal information used, and the outcome

What you must include in the notice

• Plain-English description of the ADMT and what it does
• Categories of personal information it processes
• Logic involved (high-level — you don't have to expose proprietary algorithms)
• How to exercise opt-out and access rights
• Whether the output is the sole basis for the decision

Risk assessments

Businesses must conduct risk assessments before ADMT use. Records must be kept for 24 months. The CPPA can request these on inspection.