The proposal reflects an ambitious approach without parallel in US privacy law. These rules impose three overarching obligations: (1) make robust disclosures (pre and post use); (2) offer the ability to opt out; and (3) provide detailed information in response to queries from consumers (which is California Consumer Protection Act (CCPA) jargon for 'data subjects'). But fear not! These are not final rules. Formal rulemaking has not even started. The CPPA is sharing this early draft to facilitate internal and public discussion before beginning formal rulemaking—likely sometime this year. With final rules probably taking effect sometime in 2025. What are the top-line takeaways? The key points t
Insight
California: The draft ADMT rules - top takeaways
February 29, 2024
Summary
California's draft rules on automated decision-making technology (ADMT) propose broad application, onerous disclosures, and opt-out rights for consumers, with significant changes from the December 2023 draft, such as eliminating validity testing discussions and narrowing ADMT's definition. The rules apply to businesses under the CCPA and cover ADMT used for significant decisions and extensive profiling, requiring pre-use and sometimes post-use notices, and detailed responses to consumer queries. The CPPA has not yet begun formal rulemaking, with the final rules expected to take effect possibly in 2025. The proposal is ambitious and without parallel in US privacy law, setting California apart in the privacy space with its comprehensive approach to regulating ADMT usage.