Most ADMT summaries say a California business must let people opt out of automated decisions about them, and then move on. The regulation itself has a door in that rule for two employment uses, and the door only opens if you can prove two things about your tool. If you build or buy software that ranks applicants or hands out shifts and pay, the practical question before 1 January 2027 is not "how do we build an opt-out?" but "do we qualify not to?"
This post reads section 7221(b)(2) and (b)(3) the way a product team has to: as conditions you must be able to evidence, plus the obligations that stay on even when the opt-out goes away. It is general information, not legal advice, and counsel should confirm your reading.
What does the ADMT opt-out exception for hiring say?
The California Privacy Protection Agency (CPPA) publishes the adopted CCPA regulations, effective 1 January 2026. Section 7221(a) says a business must give consumers the ability to opt out of automated decisionmaking technology (ADMT) used to make a significant decision about them, "except as set forth in subsection (b)". Subsection (b)(2) then covers admission, acceptance and hiring decisions, and it applies if two things are true: the business uses the ADMT solely to assess the person's ability to perform at work or in an educational program in order to decide whether to admit, accept or hire them, and the ADMT "works for the business's purpose and does not unlawfully discriminate based upon protected characteristics."
Subsection (b)(3) is the twin for work allocation and compensation. It covers allocation or assignment of work, and salary, hourly or per-assignment pay, incentive compensation such as a bonus, or another benefit. The same two conditions apply: the ADMT is used solely for that allocation, and it works for its purpose without unlawful discrimination.
Which decisions are outside the exceptions?
Read the definitions in section 7001(ddd)(4) next to the exceptions. Employment as a significant decision has four parts: hiring, allocation and compensation, promotion, and demotion, suspension or termination. Exceptions (b)(2) and (b)(3) reach the first two. By their text, promotion and the discipline-and-termination group are not in either one.
So a workforce platform that scores applicants, schedules shifts, and also flags people for performance action has a split position. The hiring and scheduling modules may qualify. The flagging module does not, which means it needs the opt-out or the human appeal route in section 7221(b)(1). Lending, housing, education decisions other than admission, and healthcare have no employment-style exception at all.
The word "solely" also does real work. A resume ranker used only to decide who gets interviewed fits the hiring exception. The same ranker, reused to set starting pay bands or to pick who is let go in a reduction, is being used for something the exception does not name, and the "solely" condition fails for that use.
For a team shipping a product, that turns a configuration question into a legal one. If your customers can point one score at several decisions, the exception holds for each decision only while the score stays inside its lane. Log which decision each output fed. A purpose field on every scored record is cheap now and nearly impossible to reconstruct in 2028.
What would prove the tool "works for the business's purpose"?
Here I have to be plain: the regulation does not define it. I read the full adopted text and found the phrase "works for the business's purpose" used as a condition in section 7221(b)(2)(B) and (b)(3)(B), and again in the risk assessment rules at section 7152(a)(6), where the safeguards a business documents include policies, procedures and training "to ensure that the business's ADMT works for the business's purpose and does not unlawfully discriminate." No test is given, so what follows is an engineering reading, not a safe harbour.
A defensible file is one a skeptical reviewer could audit without asking you questions. That means a written statement of what the tool is for, a validation result showing it predicts that thing (for a resume ranker, some link between the score and later job performance or at least a documented rationale for each feature), the version in use, and a re-test when the model or its input features change. A vendor who says "our tool is accurate" with no document is offering a claim, not evidence.
What does "does not unlawfully discriminate" mean in practice?
The ADMT rules do not set a bias metric either. The longest-standing US measure for hiring selection procedures is the federal four-fifths rule in the Uniform Guidelines on Employee Selection Procedures. Title 29 of the Code of Federal Regulations, section 1607.4(D), as published on the eCFR and read on 12 October 2026, says a selection rate for any race, sex or ethnic group that is less than four-fifths (or eighty percent) of the rate for the group with the highest rate will generally be regarded as evidence of adverse impact. The same paragraph says smaller differences may still count where they are significant in both statistical and practical terms, and that when the numbers are too small to be reliable, other evidence may be considered.
That makes it a screen, not a pass mark. Picture a 24-person HR-tech company whose tool advances 40 of 100 applicants from one group and 28 of 100 from another. 28 divided by 40 is 0.70, under the 0.80 line, so the screen flags it. Passing the screen would not make the tool lawful, and failing it does not make it unlawful. It tells you where to look before a regulator or a plaintiff does. The honest job for engineering is to produce the selection-rate table per release, by the groups you are able to lawfully analyse, and keep it.
What still applies if you skip the opt-out?
Quite a lot. The exceptions waive the opt-out and nothing else.
- The pre-use notice stays. Section 7220(c)(2)(B) says that if you rely on a section 7221(b) exception other than the appeal, you must identify the specific exception you are relying on in the notice. The notice also has to say whether the output is the sole factor in the decision, what the other factors are, and what a human's role is where it falls short of "human involvement". Our guide to building the pre-use notice covers the mechanics.
- Access stays. Section 7222 requires a plain-language answer about the purpose, the logic and the outcome when a person asks. The access request guide shows the logging that makes this answerable.
- Scoping stays. Whether your tool counts as ADMT in the first place turns on human involvement, covered in what counts as ADMT.
If you are a vendor, add one more item: your customer is the business making the decision and has to name the exception in its own notice. Ship them the evidence file and a configuration export showing which decisions the tool is pointed at. A customer without those cannot claim the exception on its own paper.
When is the exception the wrong answer?
If you cannot produce the validation and selection-rate evidence by 1 January 2027, claiming the exception is a bet you cannot cover, and the cheaper route may be to build the human appeal, which turns on a reviewer, a flow and deadlines rather than on statistics. If the same system also touches promotion or termination, you need an opt-out or an appeal for that part regardless, and an opt-out request starts a clock: 15 business days to stop and tell your vendors. And if you are unsure the tool is ADMT at all, settle that first.
The decision between exception, appeal and opt-out is a scoping job, and it is where a short inventory pays for itself. You can start with the free ADMT checker, which maps your decisions against the significant-decision categories. If you want an engineering team to build the notice, the decision log and whichever route you choose, see our ADMT compliance engineering service or tell us about the system.
Sources
- California Privacy Protection Agency: CCPA regulations, Title 11 Division 6 Chapter 1 (effective 1 January 2026), sections 7001(e) and (ddd), 7152, 7220, 7221 and 7222, read in full text on 12 October 2026
- Electronic Code of Federal Regulations: 29 CFR 1607.4, Uniform Guidelines on Employee Selection Procedures, information on impact, paragraph D, read on 12 October 2026
