If you sell tenant-screening or lending software with California customers, two sentences in the California Privacy Protection Agency's regulations and two subdivisions of the statute decide how much of the automated decisionmaking technology (ADMT) rule lands on you. The regulations name housing and lending as "significant decisions." The statute, in Civil Code section 1798.145, carves out personal information handled under the federal Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act (GLBA). Most teams read one sentence and stop. The answer sits in how the two fit together.
Here is the short version. The carve-out follows the data and the activity, not your product category. A screening product can have some inputs that are covered by the FCRA carve-out and some that are not, and the ADMT duties attach to the decision, which is made from all of them. This is a builder's read of the statute and regulation text, not legal advice, and counsel decides how it applies to your company.
What does the ADMT rule say about housing and lending?
Section 7001(ddd) of the CCPA regulations, effective 1 January 2026, defines a "significant decision" as one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Financial or lending services means "the extension of credit or a loan, transmitting or exchanging funds, the provision of deposit or checking accounts, check cashing, or installment payment plans."
Housing has its own narrowing clause, and it is easy to miss. Using ADMT that "provides or denies housing to a consumer based solely on the availability or vacancy of the housing or the successful receipt of payment for housing from the consumer is not making a significant decision." So an app that marks a unit as taken once the deposit clears is outside the definition. A model that scores an applicant's likelihood of paying and recommends accept or decline is not.
Section 7200(a) says a business that uses ADMT to make a significant decision concerning a consumer must comply with the whole article, which covers the pre-use notice, the opt-out (or an exception to it), access requests and the risk assessment. Section 7200(b) sets the date: compliance no later than 1 January 2027 for any use that already exists.
What do the FCRA and GLBA carve-outs actually say?
Civil Code section 1798.145(d)(1), in the statute text the CPPA posts on its site (the version it marked as updated for AB 3286 in July 2024), says the title "shall not apply to an activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" by three kinds of party: a consumer reporting agency, a furnisher of information, and a user of a consumer report as set out in 15 U.S.C. section 1681b.
Then comes the part that matters for engineering. Section 1798.145(d)(2) says that exemption applies "only to the extent" the activity is "subject to regulation under the Fair Credit Reporting Act" and the information is "not collected, maintained, used, communicated, disclosed, or sold except as authorized by the Fair Credit Reporting Act." Section 1798.145(d)(3) adds that the carve-out does not apply to section 1798.150, the data-breach section.
Section 1798.145(e) is separate. It says the title does not apply to personal information "collected, processed, sold, or disclosed subject to" the GLBA and its regulations, or the California Financial Information Privacy Act, or the Farm Credit Act. That one is written around the information itself, not the type of company.
Read plainly, both carve-outs are scoped to activity and to data, with conditions. Neither says "lenders are exempt" or "screeners are exempt."
Where does that leave a real product?
Picture a 30-person company that sells a rental-application product to property managers. This is an invented example, not a description of any company we have worked with. The product does three things.
- 1.It orders a consumer report from a consumer reporting agency and shows the result to the property manager.
- 2.It applies a house model that scores the applicant on income-to-rent ratio taken from uploaded pay stubs, plus rental history the property manager entered in the product.
- 3.It combines the two into a single recommendation: approve, approve with a larger deposit, or decline.
The first input is the one the FCRA carve-out was written for, if the activity is regulated by the FCRA. The pay stubs and the property manager's own history notes are not obviously a consumer report. The combined recommendation is a housing decision made from both. Whether the recommendation "substantially replaces" human decisionmaking under section 7001(e) depends on whether the property manager actually reviews it, as our post on what counts as ADMT explains.
The same shape appears in lending. A bank's underwriting that runs on GLBA-covered data may fall in the carve-out in section 1798.145(e). A fintech that adds data from outside that regime, such as device signals collected for fraud, or app-usage data, has information the carve-out may not cover, feeding a decision that is plainly "the extension of credit." Counsel has to say which inputs fall on which side.
My opinion, which I would defend on a sales call: do not argue the carve-out at the product level. Argue it at the field level. A team that can say "these nine inputs are FCRA data, these four are not, and here is the log" is in a much better place than one that says "we are a consumer reporting agency, so none of this applies."
What should engineering build now?
The carve-out question is a legal one, but the work that lets counsel answer it is engineering.
- 1.Inventory every decision. One row per decision your software makes or recommends: what it decides, who sees it, and whether a person can change it. The CCPA checklist for engineering teams has a starting template.
- 2.Tag every input with a legal basis. For each field feeding the decision, record its source and whether it comes from a consumer report, from a financial institution's GLBA-covered records, or from neither. A schema field named something like data_regime costs an afternoon and saves a quarter of argument.
- 3.Log the decision with its inputs. If a regulator or a customer asks which data produced a decline, the answer should be a query. Our audit trail for AI decisions post covers the record.
- 4.Prepare the in-scope path anyway. For decisions that include any non-carved-out input, the pre-use notice, the opt-out or the human-appeal exception in section 7221(b)(1), and the access response all have to exist by 1 January 2027. The human appeal build spec shows what the exception demands.
- 5.Check your contracts. If you are the vendor and your customer is the business making the decision, section 7051 contract terms and the questions your customers will send are in the vendor contract requirements post.
When is this the wrong build?
If every decision your product makes is made inside the FCRA by a consumer reporting agency, using only information collected and used as the FCRA authorizes, the ADMT article may reach very little of it, and your time is better spent on the FCRA's own adverse-action and accuracy duties. The same goes for a pure GLBA shop whose inputs all come from regulated records. If that is you, a short written memo from counsel mapping inputs to the carve-out is worth more than a notice and opt-out build.
It is also the wrong build if your software never decides anything: a tool that displays a report to a human who does the real analysis is a different question from one that outputs approve or decline.
How should you scope the work?
Start with a spreadsheet, not a sprint. List your decisions, list their inputs, and mark each input as FCRA, GLBA or neither, with a column for who confirmed it. Anything in the third column feeding a housing or lending decision is your ADMT scope. If you want help with that mapping, or with building the notice, opt-out or log for the in-scope decisions, our ADMT compliance engineering team does that work. You can run the ADMT checker to see which of your decisions are in the five categories, or talk to us with your decision list and input fields.
Sources
- California Privacy Protection Agency: California Consumer Privacy Act of 2018, statute text, Civil Code section 1798.145(d) and (e) (version posted August 2024 reflecting AB 3286)
- California Privacy Protection Agency: CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026, sections 7001(ddd), 7200 and 7221
