If your product makes a lending, housing, healthcare, insurance or similar decision with automated decisionmaking technology (ADMT), California gives you a choice on 1 January 2027: build an opt-out, or build a human appeal good enough to replace it. Most teams pick the appeal because it sounds like less engineering. It is not less engineering. It is a different queue with its own clocks, its own identity check and a reviewer who has to be a real person with real authority.
This post reads the adopted regulation text and turns the appeal exception into a spec. It is general information, not legal advice, and counsel should sign off on the final design.
What is the ADMT human appeal exception?
The California Privacy Protection Agency (CPPA) publishes the adopted CCPA regulations, effective 1 January 2026. Section 7221(a) says a business must let consumers opt out of ADMT used to make a significant decision about them. Section 7221(b)(1) then lists the first exception: the business does not have to offer the opt-out if it gives the consumer a method to appeal the decision to a human reviewer who has the authority to overturn it.
Two other exceptions exist, for hiring or admission decisions and for work allocation or compensation, both conditioned on the tool working for its purpose without unlawful discrimination. Lending, housing and healthcare decisions have no such exception. For them the choice is the opt-out or the appeal, and that is why this route matters to SaaS vendors in those markets. If you are still working out whether you are covered at all, start with what counts as ADMT and the ADMT checker.
What does the reviewer have to be able to do?
Section 7221(b)(1)(A) requires you to designate a human reviewer to review and analyze the ADMT output and any other information relevant to changing the decision. That reviewer must consider what the consumer submits in support of the appeal, may consider other sources, must know how to interpret and use the output of the tool, and must have the authority to change the decision based on their analysis.
Read that as an access-control and tooling requirement, not a staffing note. The reviewer's screen needs the score and the inputs behind it, the consumer's submission, and a button that actually changes the decision, not one that files a request to someone else. If your reviewer can only recommend, or has to escalate to a manager to reverse a result, you are building the thing the regulation says does not count. The same three-part test appears in the definition of human involvement at section 7001(e)(1), and our reading of it is that it is organizational work, not a product change.
What does the appeal flow itself have to do?
Section 7221(b)(1)(B) adds four requirements on the consumer side:
- 1.Describe clearly how to submit an appeal, and let the consumer send information to the reviewer in support of it.
- 2.Make the method easy to execute and require minimal steps, in line with section 7004.
- 3.Write the disclosures in plain language, in line with section 7003(a) and (b), which covers readability on small screens, languages and accessibility.
- 4.Meet the timelines in section 7021 and the verification rules in Article 5.
Section 7004 is where product teams get caught. Among its principles is symmetry in choice: the path to a more privacy-protective option must not be longer or harder than the path to the less protective one. For an appeal, that means the button to challenge a decision cannot be buried three screens deeper than the button that accepted it. Test it by counting taps from the decision screen to a submitted appeal.
The pre-use notice changes too. Section 7220(c)(2)(A) says that when you rely on this exception, the notice must tell the consumer about their ability to appeal and give instructions on how to submit one, instead of describing an opt-out. The notice and the appeal flow have to ship together. A notice that points at a route that does not exist is worse than no notice.
What clocks does an appeal start?
Section 7021 covers requests to appeal ADMT alongside deletion, correction and access requests. It sets two clocks:
| Clock | Rule in section 7021 | What you build |
|---|---|---|
| Confirm receipt | Within 10 business days, with a general description of verification and when to expect a response | An automatic acknowledgment on submission |
| Respond | Within 45 calendar days of receipt, counted from the day the request arrives even if verification takes longer | A due-date field set at intake |
| Extension | Up to 45 more days, 90 in total, only with notice and an explanation to the consumer | A flagged extension state that sends the notice |
Compare the opt-out. Section 7221(n) gives you 15 business days to stop processing after an opt-out request and requires you to notify downstream service providers. Section 7221(f) says you must not require a verifiable consumer request for an opt-out. An appeal is the reverse: section 7221(b)(1)(B) says you must comply with the Article 5 verification requirements, and section 7021(b) says that if you cannot verify the consumer within the 45 days you may deny the request. So the appeal route is slower to resolve but heavier at the door. Your intake needs an identity step that the opt-out route does not.
What do you have to keep?
Section 7101(a) requires records of consumer requests and how you responded for at least 24 months, kept under reasonable security. Section 7101(b) says a ticket or log works if it includes the date of the request, its nature, the manner in which it was made, the date of your response, the nature of the response, and the basis for any denial in whole or in part.
That is a usable schema for the appeal queue: a row per appeal with those six fields, plus the reviewer, the notice version the person saw and the ADMT output that was reviewed. The regulation does not demand the last three, but you will want them the first time someone asks why an appeal was upheld or denied. The same log can feed the access responses described in how to answer a California ADMT access request.
A worked example
Picture a 30-person SaaS company selling tenant-screening software to landlords with California applicants. It scores applications and recommends accept, conditional or decline. Its customers, the landlords, are the businesses under the regulation, and they will ask the vendor to ship the appeal flow.
Under the exception, the vendor needs an applicant-facing appeal form linked from the decline notice, an identity check against the application record, a case queue with a 10-business-day acknowledgment and a 45-day due date, and a reviewer role that can see the score, the inputs and the applicant's submission and can change the recommendation. It also needs a reversal path that reaches whatever system the landlord uses to send the decision, because a decision overturned in the queue but still showing as a decline downstream has not been overturned in any sense an applicant would recognize. The regulation does not spell out that last step, but I would not sign off on the build without it.
When is the appeal the wrong choice?
If your volume is high and your reviewers cannot realistically hold authority, the opt-out may be cheaper to run, because it removes the human from the loop instead of adding one. If your decisions are hiring or work allocation, the tool-quality exception may fit better, and it is an evidence project rather than a queue. And if you are not sure the reviewer will ever disagree with the tool, say so to counsel early. An override rate near zero across thousands of decisions is the number an examiner would look at first, and that is my judgment, not regulatory text.
If you are a vendor with a product team that has no spare capacity before 1 January 2027, see how we handle ADMT compliance engineering, or tell us the scope. We would not be the right call if counsel has not yet decided between the opt-out and the appeal, because that decision comes first and shapes everything above.
Sources
- California Privacy Protection Agency: CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026, sections 7003, 7004, 7021, 7101, 7220 and 7221, read in full text on 10 October 2026