CPPA finalizes automated decision technology opt-out regulations under CPRA

What the law is now

The California Privacy Rights Act amended the CCPA to require businesses to provide consumers the right to opt out of automated decision-making technology — defined as technology that makes or is a substantial factor in making decisions that produce legal or similarly significant effects on consumers. The CPPA's final implementing regulations, effective March 2026, define the right's scope and the disclosure and opt-out mechanism businesses must provide.

What just shifted

Shift us-ca Primary source

What this adds: The final regulations specify that businesses using ADT must disclose in their privacy policy what categories of decisions are made using ADT, the logic of the ADT in plain language, and how to exercise the opt-out right. The opt-out must be honored within 15 business days, and the consumer may request a human review of an ADT-influenced decision in specified categories including employment, financial products, housing, and healthcare.

What this puts in question: Whether AI-powered recommendation engines, pricing algorithms, and content moderation systems constitute ADT — the regulations use a broad definition but exclude decisions made solely by a human.

What clients should weigh

·Do you use any automated system to make or substantially influence decisions about California consumers in the areas of employment, credit, insurance, housing, health, education, or access to goods and services?

·Is your privacy policy updated to describe what ADT you use, what decisions it influences, the plain-language logic behind it, and how consumers can opt out?

·Do you have an operational process to honor opt-out requests within 15 business days and to provide human review in the required decision categories?

·The final regulations are in force. Businesses that have not updated their privacy disclosures or built an ADT opt-out mechanism are out of compliance as of March 2026.

Cal. Code Regs. tit. 11, § 7030 et seq. (CPPA Final ADT Rules, effective March 2026) ›

Watch for

· CPPA's first enforcement action under the ADT rules, signaled for 2026

· Washington My Health MY Data Act ADT intersection

· Texas Data Privacy and Security Act, ADT provisions effective July 2025

Ready to use

These are drafts. Edit before sending to a client.

Client alert

Draft — edit before sending to a client.

This corpus reflects one attorney's personal review. It is not a comprehensive survey. Verify scope and currency before relying on it for any matter.