If software already screens your applicants, approves or declines your loans or allocates your shifts, you have about 13 weeks.
Not to write a policy. To ship three working things: a notice people receive, an opt-out that stops the processing, and an answer that explains a decision to its subject.
New users of these systems get no runway at all. Existing users get exactly one, and it ends on 1 January 2027.
Why does 1 January 2027 apply to you if you already use ADMT for significant decisions today?
The California Privacy Protection Agency's ADMT rules split businesses by start date. Section 7200(b): "A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027."
Then: "A business that uses ADMT on or after January 1, 2027, must be in compliance with the requirements of this Article any time it is using ADMT for a significant decision."
A system you already run is due on 1 January. A system you launch in February is due on first use. The duties: a Pre-use Notice (7220), a right to opt-out of ADMT (7221) and a right to access ADMT (7222).
Which of your existing decision flows count as ADMT for a significant decision?
You need a list, not a thesis. Two tests, both in section 7001.
Is it ADMT? Section 7001(e) defines automated decisionmaking technology as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." The definition does not mention AI. A rules engine can qualify.
"Substantially replace" means the output drives a decision "without human involvement." Human involvement requires a reviewer who can interpret the output, reviews it, and can "Have the authority to make or change the decision" (7001(e)(1)). Databases and spreadsheets are excluded, but only "provided that they do not replace human decisionmaking" (7001(e)(3)).
Is the decision significant? Section 7001(ddd): "a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services."
Employment is the widest limb: under (ddd)(4), hiring, "Allocation or assignment of work," compensation, promotion, and "Demotion, suspension, and termination." Advertising is out (ddd)(6).
Ticket: one row per flow: system, (ddd) decision type, (e)(1) reviewer test, vendor, consumer population.
What must the Pre-use Notice say, and when do existing customers, applicants and employees have to get it?
Section 7220(b)(2) requires the notice "at or before the point when the business collects the consumer's personal information that the business plans to process using ADMT." Then: "If a business has already collected the consumer's personal information for a different purpose and subsequently plans to process it using ADMT for the purpose set forth in section 7200, subsection (a), the business must provide a Pre-use Notice before processing."
Your employees, your loan book, your applicant pipeline: their data was collected under older notices, and the text does not grandfather them. Read with 7200(b), they need a Pre-use Notice before processing continues past 1 January.
It must also be "presented in the manner in which the business primarily interacts with the consumer" (7220(b)(3)). For employees, likely the HR portal, not a footer link on the marketing site.
The content in 7220(c):
- Specific purpose. Not generic terms "such as 'to make a significant decision'" (c)(1). Name the decision.
- Opt-out right and how to use it (c)(2), or the exception language covered below.
- Access right and how to request it (c)(3).
- No retaliation for exercising CCPA rights (c)(4).
- How the ADMT works (c)(5), which can sit behind a layered notice or hyperlink: the categories of personal information that affect the output (A), the type of output and how it is used, which may include, for example, "whether the output is the sole factor" (B), and "What the alternative process for making a significant decision is for consumers who opt out" (C).
That last item is not a drafting task. If no manual path exists, operations has to build it first.
Two reliefs. The notice may sit inside your Notice at Collection if it carries everything in (b) and (c) (7220(a)). And 7220(e) allows a consolidated notice, for example one employer notice covering "productivity monitoring software to determine the employee's allocation/assignment of work and compensation, and to determine which employees will be demoted." Section 7220(b)(1) also cross-references section 7003, subsections (a)-(b).
What does a working ADMT opt-out need: two methods, no account, 15 business days and a downstream instruction?
Section 7221(c) requires "two or more designated methods," with at least one reflecting how you primarily interact with the consumer. If you interact online, (c)(1) sets a floor: "an interactive form accessible via an opt-out link that is provided in the Pre-use Notice," with a link title that states what is being opted out of, "such as 'Opt-out of Automated Decisionmaking Technology.'"
Your cookie banner "is not by itself an acceptable method" (7221(c)(4)).
The intake rules:
- No account creation, and no information beyond what is necessary to direct the opt-out (7221(e)).
- No verifiable consumer request (7221(f)).
- A means for the consumer to confirm the opt-out was processed (7221(h)).
- If you offer granular choices, you must also offer "a single option to opt-out of all of the business's uses of ADMT" (7221(i)).
- Wait "at least 12 months" before asking for consent again (7221(k)).
Then the two clocks.
If the opt-out arrives before processing starts, 7221(m) is absolute: "the business must not initiate processing of the consumer's personal information using that ADMT." Your pipeline needs a gate before the engine runs.
If it arrives after processing starts, 7221(n)(1) requires you to stop "as soon as feasibly possible, but no later than 15 business days from the date the business receives the request." And (n)(2) requires notifying every service provider, contractor or other person processing that data with that ADMT, "instructing them to comply with the consumer's request to opt-out of that ADMT within the same time frame."
That limb is where the calendar bites. If your applicant tracking or underwriting vendor runs the scoring, you need a contractual and technical channel to pass the instruction. Vendor paper rarely moves in 13 weeks; map it through third-party risk.
When can you rely on an exception instead of an opt-out, and what must the notice then say?
Section 7221(b) lists three exceptions. Here is what each changes in the notice.
Human appeal (7221(b)(1)). You provide a method to appeal to a human reviewer "who has the authority to overturn the decision." The notice must then "instead inform the consumer of their ability to appeal the decision and provide instructions to the consumer on how to submit their appeal" (7220(c)(2)(A)). The appeal process also cross-references sections 7003, 7004, 7021 and Article 5.
Admission, acceptance or hiring (7221(b)(2)) and allocation of work or compensation (7221(b)(3)). Each requires that you use the ADMT "solely" for that assessment and that it "works for the business's purpose and does not unlawfully discriminate based upon protected characteristics." Under 7220(c)(2)(B), the notice "must identify the specific exception it is relying upon."
Note "solely." A hiring score that also feeds promotion is doing two jobs. And no exception removes the Pre-use Notice or the access right.
What must your answer to a request to access ADMT explain about logic and outcome?
Section 7222(b) requires plain language explanations of four things, per consumer:
- Purpose "with respect to the consumer," not generic terms "such as 'to improve our services'" (b)(1).
- Logic. "Information about the logic of the ADMT," enough for the consumer "to understand how the ADMT processed their personal information to generate an output with respect to them," which may include the parameters and "the specific output with respect to the consumer" (b)(2).
- Outcome. How you used the output to make the decision, for example "whether the output was the sole factor" and which other factors played a role (b)(3). If you plan to reuse that output for a future significant decision, you must explain how (b)(3)(A).
- No retaliation, plus instructions for exercising other CCPA rights, which "must include any links to an online request form or portal for making such a request, if offered by the business" (b)(4). You may comply by linking directly to the specific privacy policy section containing those instructions (b)(4)(A).
Unlike the opt-out, access requests are verified. Section 7222(e): "A business must comply with the verification requirements set forth in Article 5 for requests to access ADMT." You may reuse your existing request channels for know, delete and correct (7222(d)).
Three more provisions shape the build:
- Carve-outs. The logic and outcome explanation need not include trade secrets or information that would compromise security, fraud-resistance or physical safety (7222(c)).
- Vendor assistance. Service providers and contractors "must provide assistance" (7222(i)). Put it in the contract.
- Aggregate responses. If you used the ADMT on a consumer "more than four times within a 12-month period," you may summarise outputs and average parameters over the preceding 12 months (7222(j)). Continuous tools like shift allocation may qualify.
The hard dependency is logging. You cannot explain an output you did not keep.
What can a California business realistically build in the 13 weeks left?
Weeks 1-2: Privacy. Finish the inventory; decide opt-out or a named 7221(b) exception per flow. Artefact: ADMT register with exception basis.
Weeks 1-4: Operations (lending, underwriting, HR). Design the alternative process for people who opt out, or the human appeal path. Artefact: documented alternative process per flow, feeding 7220(c)(5)(C).
Weeks 2-6: Privacy with legal. Draft Pre-use Notices, consolidated where 7220(e) allows. Artefact: approved notice text per population.
Weeks 3-9: Product and engineering. Opt-out link and form, a second method, confirmation, the 7221(m) gate, a stop tested against 15 business days, per-decision output logging. Artefact: end-to-end test evidence.
Weeks 3-10: Procurement with HR or ATS and underwriting vendors. Amend contracts for opt-out propagation under 7221(n)(2) and access assistance under 7222(i). Artefact: signed amendments and a tested notification channel.
Weeks 8-12: Privacy operations. Access response template for logic, outcome and future use, plus the aggregate variant. Artefact: one worked sample per flow.
Weeks 11-13: Delivery. Send Pre-use Notices to existing consumers through your primary channel. Artefact: dated delivery records.
If something slips, protect the notice and the opt-out gate. They are the parts a consumer meets first.
At Aigis GRC every obligation in 7200, 7220, 7221 and 7222 is traced to a verbatim quote from the legal text and linked to its owner, vendor and evidence on the platform, alongside the risks each flow carries. The ADMT evidence pack is a query, not a project.
Answer once. Assess everything. → agrc.ai
FAQ: CPPA ADMT compliance by 1 January 2027
Our resume screener replaced human screening years ago. When must we comply?
No later than 1 January 2027, under 7200(b), if it is ADMT making a significant decision.
Do existing employees need a Pre-use Notice if we collected their data years ago?
Yes, before you process it using ADMT for a significant decision. Section 7220(b)(2) covers personal information "already collected ... for a different purpose."
Can we verify identity before honouring an opt-out of ADMT?
No. Section 7221(f) bars requiring a verifiable consumer request. Access requests, by contrast, are verified under 7222(e).
Does ADMT used to target job ads count?
Not as a significant decision. Section 7001(ddd)(6) states that "Significant decision does not include advertising to a consumer."
