California Finalizes ADMT Rules Under CCPA, Effective 2026

California has introduced new rules under the California Consumer Privacy Act (CCPA) that will significantly affect how businesses use automated decision-making technology (ADMT), according to a Bloomberg Law report. The regulations, which also cover cybersecurity audits and risk assessments, will take effect on January 1, 2026, with compliance for companies using ADMT in significant decision-making required by January 1, 2027.

The California Privacy Protection Agency (CPPA) began drafting the new regulations in November 2024. The rulemaking process drew responses from technology companies, advocacy groups, and public officials, many of whom expressed concern that the proposed definition of ADMT was too broad. Governor Gavin Newsom urged the agency to ensure the rules did not unintentionally limit innovation in the technology sector.

The new framework will require organizations operating in California to reassess how they secure personal data, conduct risk assessments, and manage automated systems that influence decisions about consumers. Meeting the applicability thresholds set by the CPPA could mean substantial operational changes for companies managing large volumes of personal data or relying heavily on automation.