The California Privacy Protection Agency has recently made changes to its proposed rules on automated decision-making tools (ADMTs) under the California Consumer Privacy Act (CCPA). These modifications have raised concerns as they limit the types of automated systems that would be covered by the regulations. During a meeting on May 1, 2025, agency staff indicated that only 10 percent of California businesses subject to the statute would fall under the updated version of these rules. Further revisions are expected to reduce this number even more.
The Center for Democracy & Technology (CDT) has expressed its concerns about these changes. The organization argues that reducing transparency obligations undermines the purpose of both the ADMT regulations and the CCPA, which aim to prevent privacy harms caused by such tools.
In response, CDT submitted comments urging a return to an earlier version of the rules that offered better consumer protection. They recommended expanding the definition of ADMTs, broadening profiling types subject to regulation, ensuring significant decisions involving ADMTs are covered, and restoring provisions that were narrowed or removed.