Cybersecurity Policy Report, Privacy Groups Complain About CPPA’s ADMT Rule, (Jul 25, 2025)

By Jeff Williams

In a decision that drew criticism from some privacy and consumer groups, the California Privacy Protection Agency (CPPA) yesterday voted unanimously to adopt rules regarding automated decision-making technology (ADMT) that the agency said would “strengthen Californians’ privacy rights, giving them more control over how their personal information is used and increasing transparency when businesses use ADMT.”

The CPPA said it planned to file the proposed rules, called for by the California Consumer Privacy Act, with the Office of Administrative Law for final approval.

The CPPA’s decision incorporated revisions the agency made in May to draft regulations it released in November 2024 that appeared to be designed to remove perceived barriers to compliance with the rules by California businesses and to reduce the cost of compliance for such businesses. Among other things, the adopted revisions removed the definition of “artificial intelligence” from the original draft, which the board said would permit the state Legislature to consider a comprehensive AI law similar to the one recently enacted in Colorado.

The rules also specify that certain opt-out and transparency requirements would apply only to “significant decisions,” which the rules now provide will include decisions relating to financial or lending services, housing, educational enrollment or opportunities, various employment opportunities or compensation, and health care. The final version also removed provisions related to insurance, criminal justice (like the posting of bail bonds) and essential goods or services (like groceries, medicine, hygiene, or fuel) from the definition of “significant decisions” and revised the proposed rules on risk assessment to remove a prior requirement that businesses deploying ADMT or AI must identify actions taken or planned to maintain the quality of personal information processed.

In a post on its website, the Electronic Privacy Information Center (EPIC) said the agency’s decision to “finalize regulations that have been significantly watered down over the past months is disappointing. Initial drafts of the regulations were quite privacy-protective, but after intense lobbying from Big Tech companies and others, the CPPA voted to weaken the rules and remove several key provisions that would have better protected Californians.”

In a statement, Ridhi Shetty, senior policy counsel at the Center for Democracy & Technology’s Privacy & Data Project, said the CPPA had “acceded to industry demands to limit the new ADMT rule’s protections to systems that have essentially no human review.”

Under the new rule, she said, "even rote human review that involves rubber-stamping ADMT outputs would likely allow companies to avoid accountability entirely. ... The agency has given industry a roadmap to avoid the protections it just spent years enacting. We hope the agency improves the rule in the future."

In a news update on its website, Consumer Watchdog said the agency “approved a package of gutted regulations,” which “isn’t what Californians voted for. They voted for meaningful privacy protections that have not been watered down by large companies."

At yesterday’s meeting, the agency also adopted modified versions of rules regarding cybersecurity audits and risk assessments.

News: StateLegislation DataPrivacy AINews CCPA