CCPA and Automated Decision-Making: The Builder's Brief

California's privacy regulator has adopted regulations under the CCPA that address automated decision-making technology (ADMT): software that replaces or substantially replaces human decision-making. For builders, the practical message is that significant automated decisions about California consumers now come with notice, opt-out, and access obligations that your pipeline design either supports or fights.

This is a builder's orientation, not legal advice. The regulation text, its thresholds, and its compliance dates are what count, and they belong with your counsel. Start with the general picture in automated decision-making.

What the CCPA ADMT rules are about

The regulations focus on ADMT used to make significant decisions about consumers, the kind that affect financial or lending services, housing, education, employment, or healthcare. In broad terms, businesses using ADMT for those decisions face obligations in three areas:

• Pre-use notice: telling consumers ADMT is used and how.
• Opt-out rights: letting consumers opt out in many cases, with exceptions the regulations define, including some tied to human review or appeal.
• Access rights: explaining, on request, how the technology was used in a decision about them.

Related rules on risk assessments and cybersecurity audits sit alongside these. Scope, exceptions, and dates are exactly the details to confirm with counsel against the current text from the California Privacy Protection Agency.

Does your pipeline count as ADMT?

The questions to bring to counsel:

• Does the system's output decide, or substantially decide, something significant about a consumer?
• Is there meaningful human review, where a person can and does change outcomes?
• Is the business covered by the CCPA at all?

Most operational verdict pipelines (routing tickets, labeling emails, scoring content) don't make significant decisions about consumers. Pipelines touching hiring, lending, housing, or education might. Know which you run.

What to build regardless

Good ADMT hygiene is also good engineering, so these habits pay off whatever counsel concludes:

Log every decision with its reasons. Inputs used, question version, probabilities, and the human who confirmed. That record is what an access request draws on. The format is in verdict logging and audit trails.

Make human review real. A reviewer who sees the evidence and can change the outcome. Human-in-the-loop design covers queue rules that keep review from becoming rubber-stamping.

Build an opt-out path in the architecture. A consumer-level flag that routes their cases to manual handling is far easier to add at design time than after launch.

Write the notice from the questions. Closed questions are plain language already. "We check whether your application includes the required documents" is a notice sentence written by the pipeline itself.

Where decision models help, and where they don't

A decision model like Jev (what Jev is) makes the logic legible, one closed question per decision with a probability attached. That supports explanation and audit. It doesn't settle whether you're covered, whether an exception applies, or whether your notice is adequate. Those are legal questions, and this page's answer to all of them is: ask counsel.

Frequently asked questions

What is ADMT under the CCPA?

Automated decision-making technology: technology that processes personal information to replace or substantially replace human decision-making. The regulation text defines it precisely.

Does the CCPA ban automated decision-making?

No. The regulations add notice, opt-out, and access obligations for significant decisions. Confirm details with counsel.

When do the CCPA ADMT rules apply?

Compliance dates are set in the regulations and have phased timelines. Check the current text from the California Privacy Protection Agency.

Does meaningful human review change my obligations?

It can affect which obligations apply. Review must be genuine, with authority to change outcomes. Counsel should confirm how it applies to your design.

Is this page legal advice?

No. It's an engineering orientation. Take the questions above to a qualified lawyer.