CCPA automated decisionmaking rules for employers: what applies to hiring from January 1, 2027

From January 1, 2027, a business covered by the California Consumer Privacy Act that uses automated decisionmaking technology (ADMT) to make a hiring, pay, work-allocation, promotion, demotion or termination decision must give candidates a pre-use notice, let them opt out unless a named exception applies, and explain on request how the tool reached its output. It also needs a risk assessment, a duty that has applied to new processing since January 1, 2026. ADMT means technology that replaces or substantially replaces human decisionmaking, so a tool whose output a qualified person reviews and can overrule is outside the ADMT article. These rules come from the California Privacy Protection Agency's regulations, approved on September 22, 2025 and in effect since January 1, 2026, as of October 2026.

Our page on CCPA and job applicant data covers the notice at collection, candidate rights and retention. This page goes section by section through the ADMT rules themselves: what counts, what the notice says, how the opt-out and its exceptions work, what an access answer contains, and when a risk assessment is due.

What are the key dates?

The obligations fall on a CCPA "business", the same thresholds that decide whether candidate data is covered at all. Applicant and employee data has been fully in scope since the employment exemption became inoperative on January 1, 2023; the threshold detail is in the applicant data guide.

What counts as automated decisionmaking technology in hiring?

Section 7001(e) defines ADMT as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." Substantially replacing means the business uses the output "to make a decision without human involvement." Human involvement has three parts. The reviewer must:

1. know how to interpret and use the technology's output to make the decision;
2. review and analyze the output, and any other information relevant to make or change the decision; and
3. have the authority to make or change the decision based on that analysis.

ADMT expressly includes profiling that replaces human decisionmaking, and it excludes ordinary tools such as databases, spreadsheets, calculators and spam filters "provided that they do not replace human decisionmaking." A "significant decision" covers employment or independent contracting opportunities or compensation, defined in § 7001(ddd)(4) as hiring; allocation or assignment of work, and pay including bonuses and benefits; promotion; and demotion, suspension and termination. For staffing firms, the allocation clause matters as much as hiring: software that decides which temp gets which assignment is in scope.

The definition turns on how a tool is used, not what it is. Applied to common hiring setups:

The practical test is the one the regulation writes down: could your reviewer explain the output, did they look at more than the output, and could they have decided differently? If the honest answer is no, plan for the ADMT duties below.

What must the pre-use notice say?

Section 7220 requires a Pre-use Notice, presented "prominently and conspicuously" at or before the point you collect the personal information you plan to run through ADMT, in the way you mainly interact with the candidate. If you already hold the data for another purpose, the notice comes before the new processing. It can sit inside your notice at collection if it carries everything required. It must include:

• a plain-language explanation of the specific purpose; "to make a significant decision" is called out as too generic;
• the right to opt out and how to do it, or, if you rely on the human appeal exception, how to appeal; if you rely on another exception, which one;
• the right to access information about the ADMT and how to request it;
• that you may not retaliate against people who exercise their CCPA rights; and
• how the ADMT works: the categories of personal information that affect the output, the type of output and how it is used (including whether it is the sole factor and what any human's role is), and the alternative process for people who opt out. This part may be layered behind a link.

Trade secrets and information that would compromise security, fraud prevention or physical safety may be left out (§ 7220(d)). One notice can cover several tools for one purpose: the regulation's own example is a job applicant notice covering both resume screening software and software that evaluates "vocal intonation, facial expression, and gestures."

Pre-use notice: automated screening  [example to adapt with counsel]

How we use automated decisionmaking technology for this role
We use [tool type] to [specific purpose, e.g. score each application
against the five requirements listed in the job posting and decide
which applicants are invited to a phone screen].

What it uses: [categories, e.g. work history, skills, certifications
and answers to the application questions]. It does not use [e.g.
photos, age or graduation dates].
What it produces: [e.g. a score from 1 to 5 per requirement]. Applicants
scoring [x] or above are invited to a screen; [describe any human role].

Your choices
- Opt out: [link titled "Opt-out of Automated Decisionmaking
  Technology"] or [email / phone]. If you opt out, [describe the
  alternative, e.g. a recruiter reviews your application manually
  against the same five requirements].
  [Or, if relying on an exception: "We rely on the exception in
  section 7221(b)(2) because ..."; or appeal instructions.]
- Access: you can ask how the tool was used for you: [link].
We will not retaliate against you for using these rights.

Can candidates opt out, and when is an opt-out not required?

Section 7221(a) makes the opt-out the default. Section 7221(b) lists three exceptions:

Where the opt-out applies, the mechanics are specific:

• At least two methods, one matching how you mainly interact with candidates. Online, that means an interactive form behind a link in the Pre-use Notice whose title says what is being opted out of. A cookie banner does not count.
• No account creation, no verifiable consumer request, and no more information than needed to find the person.
• If someone opts out before processing starts, you must not start. If they opt out later, stop within 15 business days and instruct service providers to do the same within that time (§ 7221(m), (n)).
• Provide a way to confirm the opt-out was processed, and wait at least 12 months before asking the person to opt back in.

What must you tell a candidate who asks how the decision was made?

Under § 7222, an access request about ADMT gets plain-language explanations of the specific purpose for which the tool was used for that person; the logic, in enough detail to understand how it processed their information to produce their output; and the outcome, including how the output was used, whether it was the sole factor, what other factors mattered and what any human's role was. The response also restates the no-retaliation rule and explains how to exercise other CCPA rights.

Verification rules apply, trade secrets may be withheld, and a business that used the same ADMT on a person more than four times in 12 months may give an aggregate answer. Service providers must help you answer. For a recruiting team the hard part is the logic: if your vendor cannot tell you which inputs move a score, you cannot tell the candidate.

When do employers need a risk assessment?

Risk assessments reach further than the ADMT article. Section 7150(b) lists the triggers, and three are common in hiring:

• using ADMT for a significant decision (b)(3);
• using automated processing to infer or extrapolate a job applicant's or employee's "intelligence, ability, aptitude, performance at work," reliability, predispositions or behavior, among other listed traits, "based upon systematic observation" (b)(4). Systematic observation expressly includes "video or audio recording," so an AI tool that scores recorded interviews can trigger an assessment even where a person makes the final call; and
• processing personal information you intend to use to train ADMT for a significant decision, or to train facial-recognition, emotion-recognition or other physical or biological profiling technology (b)(6).

The regulation's first worked example is a hiring case: a business that videotapes interviews and uses emotion-recognition technology without human involvement to decide who to hire must do a risk assessment.

Section 7152 sets the contents: the specific purpose; the categories of personal information, including the minimum needed; the collection, use and retention method; how many people are affected; what they were told; which vendors receive the data; for ADMT, the logic, its assumptions and limitations, and how the output is used; the benefits; the negative impacts, which expressly include discrimination; the safeguards; whether you will go ahead; and who contributed, reviewed and approved it. The stated goal in § 7154 is to restrict or stop processing where the privacy risks outweigh the benefits.

Timing under § 7155: before processing starts, reviewed at least every three years, updated within 45 days of a material change, and kept for as long as the processing continues or five years after completion, whichever is later. Each year a member of executive management submits summary information and an attestation under penalty of perjury (§ 7157), and the CPPA or the attorney general can demand the full reports on 30 days' notice.

What do your vendors owe you?

A vendor that makes ADMT available to you for a significant decision must give you "all facts available" that you need to do your own risk assessment (§ 7153), and service providers must help you answer access requests (§ 7222(i)). Ask before January 2027:

• Which features, if any, make or substantially make a decision without a person? Can those be switched off?
• Which inputs affect the output, and can you explain the logic for one named candidate?
• What validity and bias testing exists, by whom, and when was it last run?
• Can the tool stop processing one candidate within 15 business days of an opt-out?
• Does the vendor train models on your candidates' data?

How does this fit with California's other AI hiring rules?

The CPPA rules sit beside the Civil Rights Council's regulations under the Fair Employment and Housing Act, which have applied since October 1, 2025. Those cover automated-decision systems that facilitate a human decision as well as ones that replace it, and require employment records, including automated-decision data, to be kept for four years; see California's AI hiring regulations. A tool can therefore fall under the FEHA rules without being ADMT under the CCPA. Outside California, Colorado's rules start on the same date, January 1, 2027; see the Colorado guide and the state-by-state summary.

What should employers do before January 1, 2027?

1. List every tool that touches candidates or workers and mark which ones score, rank, filter, advance, assign or reject.
2. For each, write down who reviews the output, what else they look at, and whether they can change the result. Fix the review, or treat the tool as ADMT.
3. For ADMT, choose: offer the opt-out with a real alternative process, set up a human appeal, or document the hiring-assessment exception with validity and bias evidence.
4. Draft the Pre-use Notice, and add the opt-out or appeal link where candidates first give you data. Wording for wider AI notices is in the AI disclosure templates.
5. Build an access-request answer for each ADMT, with the vendor's help.
6. Start risk assessments now for tools in use before 2026, since § 7155(b) gives you until December 31, 2027, and for anything inferring ability from recorded interviews.
7. Name the executive who will sign the April 2028 submission.