California · CCPA · ADMT
Your lawyer tells you what the rule requires. We build it.
California’s automated decisionmaking rules arrive as a list of tickets rather than a policy memo. A notice that renders before a decision gets made, a way for a person to say no, a log detailed enough to reconstruct why the software decided what it did, and a human with the authority to overturn it.
Most teams have read a law firm summary and filed the whole thing under legal. That is how you reach the 1 January 2027 date with no plumbing.
What we build
Four rights attach on 1 January 2027 (section 7200(b)). They map onto roughly four pieces of engineering, though not one to one, because the opt-out and the appeal are partly substitutes for each other.
Pre-use notice
Section 7220
A notice that renders before the decision is made, describing how the technology works, what personal information it uses, what it outputs, and what happens on opt-out.
How we approach itOpt out
Section 7221
A path for a person to refuse ADMT processing, or a documented exception plus a human-appeal route good enough to substitute for it.
How we approach itAccess
Section 7222
A decision log detailed enough to answer "why me?": inputs, output, logic and the reviewer's role, retained and retrievable per person.
How we approach itAppeal
Section 7221(b)(1)
A place for requests to land, and a path to reverse a decision that has already propagated downstream.
How we approach it
Two ways to start
Both are fixed in scope and priced in writing before anything begins. Which one fits depends on whether you are the business making the decisions or the software vendor whose product makes them.
For the business making the decisions
ADMT readiness sprint
Two weeks, fixed scope. We inventory every automated decision that touches the five significant-decision categories, run the reviewer interviews, and hand your counsel a gap list they can sign off against the regulation.
- Decision inventory, traced from outcome back to the system that produced it
- Human-involvement findings for each reviewer role, honestly stated
- Gap list against the notice, opt-out, access and appeal requirements
- An implementation plan with sequencing against the 1 January 2027 date
Then, if you want us to, we build what the plan says. You are free to take the plan to your own team instead.
For SaaS vendors with California customers
ADMT feature pack
If your product scores, ranks, filters or recommends people in hiring, lending, housing, healthcare or education, your California customers will need pre-use notices, opt-out handling and decision logging from your product by January 2027, and their contracts with you will say so. We build those features into your product on a fixed-scope basis.
- Pre-use notice component your customers can configure per decision
- Opt-out and human-review request flows, with the exceptions the rule allows
- Decision log schema and access-request export that can answer "why me?"
- Vendor-contract evidence: the documentation your customers will ask you for
Scoped against your stack and roadmap so your own team keeps shipping the product while the compliance surface gets built alongside it.
How an engagement runs
- 01
Readiness pass
A decisions-first inventory, not a systems-first one. We start from the five significant-decision categories and trace backwards to whatever produces the output, because a systems-first pass misses the spreadsheet in HR every time.
- 02
The reviewer interview
The human-involvement test in section 7001(e)(1) is a question about working practice, not code. We sit with the people who actually review these outputs and establish, honestly, whether they clear all three parts. This is the cheapest finding available and the one most often assumed rather than checked.
- 03
Build the four things
Pre-use notice, opt-out or a good-enough appeal, a decision log that can answer "why me?", and somewhere for requests to land. Built into your stack, not bolted alongside it.
- 04
Evidence for the filing
The risk assessment is an engineering document wearing a suit. We produce the artifacts your counsel needs to file, rather than leaving them to reverse-engineer it from your codebase.
The five decisions that put you in scope
The list in section 7001(ddd) is exhaustive, which narrows the work usefully. Teams routinely over-scope here and burn a quarter inventorying systems the rule never touched, and under-scope, because “employment” is far broader than hiring.
Financial or lending services
Loan or credit approval · Credit limit setting · Insurance underwriting or terms
Housing
Tenant screening or scoring · Rental application approval
Education enrollment or opportunities
Admissions decisions · Programme or course placement
Employment or independent contracting opportunities or compensation
Applicant ranking or screening · Allocation or assignment of work (e.g. which shifts someone gets) · Compensation, including incentive and bonus eligibility · Promotion, discipline or termination
Healthcare services
Care authorisation or hours · Triage or acuity scoring · Coverage determinations
Two more CCPA obligations
The same regulations ask some businesses for a risk assessment and a cybersecurity audit. Both come with their own dates and evidence, and each has a page of its own.
Sections 7150 to 7157
CCPA risk assessment
Who needs one, what the report must contain, the dates that apply, and the engineering evidence we build for it.
Sections 7120 to 7124
CCPA cybersecurity audit
Who must complete one, when the first report is due, what the auditor examines, and what we build for it.
The build guides, by obligation
Each guide takes one obligation and says what the code has to do. Start with the one that matches the right you are least ready for, or read the overview of what your engineering team has to build.
Scope
Pre-use notice
Opt-out and appeal
Access and the decision log
Risk assessment
Vendors and security
Enforcement so far
- CCPA In-App Opt-Out: What the Lyft Settlement Requires
- CCPA Data Minimization: What the GM Settlement Requires
- CCPA Opt-Out Enforcement 2025: Honda, Todd Snyder
- CCPA Opt-Out Across Devices: What the Disney Case Says
- CCPA Tracking Pixel Audit: What the PlayOn Order Required
- California's First Algorithmic Work-Decision Audit
Common questions
ADMT stands for automated decisionmaking technology. Section 7001(e) of the CCPA regulations defines it as technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. The rules bite when a business uses it for a significant decision about financial or lending services, housing, education, employment or healthcare (section 7001(ddd)). Your counsel decides whether a given system counts.
Yes. The CCPA covers personal information whatever system uses it, and its ADMT rules add duties for significant decisions. The ADMT definition in section 7001(e) never mentions artificial intelligence. It asks whether computation replaces human decisionmaking, whether or not the system uses machine learning. Training an ADMT for a significant decision on personal information also triggers a risk assessment (section 7150(b)(6)). Your counsel decides how this applies to you.
They give people four rights over ADMT used for a significant decision: a pre-use notice, opt-out, access and appeal. A business already using ADMT for a significant decision must comply by 1 January 2027 (section 7200(b)). Only five categories of decision count: financial or lending services, housing, education, employment and healthcare (section 7001(ddd)).
They are part of the CCPA regulations. California voters approved the California Privacy Rights Act (Proposition 24) in November 2020. It added new privacy protections to the CCPA instead of replacing it, and it established the California Privacy Protection Agency, which adopted the regulations that contain the ADMT rules. Search results use both names for the same law.
No, and you should be wary of an engineering firm that says otherwise. Your counsel decides whether you are covered and which of your decisions count. We build what they tell you that you owe, and we produce the technical evidence they need in order to advise you.
Law firms tell you what the regulation requires. Almost none of them can build a pre-use notice that renders before a decision, a decision log detailed enough to answer an access request, or a path to reverse a decision that has already propagated downstream. That gap between the advice and the working system is the whole of what we do.
It depends far less on your codebase than on how quickly we can get time with the people who run the affected processes. The inventory is slower than the builds for exactly that reason. We scope it against your calendar, not your repo size.
Then we tell you that and stop, and you have found out in 2026 rather than 2028. That is a far cheaper outcome than the alternative, and we would rather say so early than build something nobody needed.
Yes, and it is usually the better arrangement, because your team knows where the decisions actually live. We can embed engineers into your team or take the work end to end. See our staff augmentation and dedicated team options.
Indirectly, and soon. The regulation binds the business using the technology, but that business cannot comply without its vendors. When a person opts out, section 7221(n)(2) requires it to notify every service provider and contractor it shared their information with for that ADMT, and sections 7050 and 7051 set what its contracts with service providers and contractors must say. In practice your California customers will ask for pre-use notice support, opt-out handling, decision logging and documentation, and a vendor that cannot supply them becomes the reason a customer fails their own compliance. The feature pack above exists for exactly that situation.
Section 7200(b) requires a business already using ADMT for a significant decision to be in compliance by 1 January 2027. Risk assessments for processing that began before 1 January 2026 must be documented by 31 December 2027 (section 7155(b)) and submitted to the Agency by 1 April 2028 (section 7157(a)(1)).
Sources
Section numbers on this page refer to the California Privacy Protection Agency’s CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026. The agency lists amendments on its regulations page. This page is our reading of the published text, not legal advice.
Start with the cheapest question
Tell us which of the five categories your business touches and we will tell you what a readiness pass would cover and what it would leave alone. If your reviewers genuinely clear the involvement test, that is a much cheaper thing to learn now than in 2028, and we would rather say so early.