Colorado ADMT rules: hearing and last day for written comments · Oct 26, 2026 · See what changes
The California Consumer Privacy Act, which covers personal information of California residents. It gives consumers rights to know what personal information is collected, request deletion, opt out of sale or sharing, and not be discriminated against for exercising these rights. The California Privacy Rights Act (CPRA) amended the CCPA. Regulations approved on September 22, 2025 took effect January 1, 2026. They add consumer rights to access and opt out of businesses' use of automated decisionmaking technology (ADMT), plus risk assessments and cybersecurity audits for certain businesses. Businesses that use ADMT to make significant decisions have until January 1, 2027 to comply with the ADMT rules.
Why this matters for your team
If you serve California users and use AI that profiles them or makes significant decisions about them, plan for CCPA's automated decision-making rules, which businesses must follow from January 1, 2027. Review your AI tools' data-sharing terms: 'selling' data to a vendor for training may trigger opt-out requirements.
A California consumer can request that a company disclose whether it uses AI to evaluate their credit application and can opt out of certain AI-driven profiling under CCPA.