CPPA – Draft Automated Decisionmaking Technology Regulations

by Rutuja Deshpande

On November 27, 2023, the California Privacy Protection Agency (CPPA) released the draft automated decisionmaking technology regulations (ADTR) aiming to regulate consumer facing corporate use of artificial intelligence (AI). Along with the ADTR, CPPA also released an overview of the proposed framework for automated decisionmaking technology and key topics for their board meeting which was to be held on December 10, 2023.

Some of the key takeaways from the draft regulations:

1. Definitions: ADTR defines the term “automated decisionmaking technology” (ADMT) to mean such technology that processes personal information and uses computer programs to assist in decisionmaking by humans. The term also includes “profiling,” which refers to ‘any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements’.

2. Pre-use Notice: ADTR requires businesses using ADMT to provide consumers with a “Pre-use Notice” informing them about the use of ADMT, their right to opt out of and gain access to the information about business’s use of ADMT. The Pre-use Notice would be shared with a consumer prior to the processing of a consumer’s personal information using ADMT. Businesses would be required to publish a Pre-use Notices using plain language and the purpose should not be generically described to make it easy for a consumer to understand how exactly that business proposes to use ADMT. Businesses would also have to provide a consumer access to information about how the business uses ADMT that affects actual outcome, parameters affecting such outcome, decisionmaking process and evaluation process related to the businesses’ use of ADMT. Certain exceptions have also been provided.

3. Right to Opt Out: Consumers would be provided with an option to opt out where a business uses ADMT for the purposes of (i) arriving at decisions that produce legal or similarly significant effects concerning a consumer; (ii) profiling a consumer acting in their capacity as an employee, independent contractor, job applicant, or student; and (iii) profiling a consumer in a publicly accessible place. The opt out process should not be complicated and can have various choices from which a consumer can make a selection. Further, ADTR also specifies that businesses have a right to verify opt out requests and deny any such fraudulent requests. Consumers should also be given an opportunity to lodge complaints about the business’s use of ADMT. The regulations also provide for exceptions for security, safety and fraud prevention.

4. Right of Access to Information: ADTR provides for a right to access information about a business’s use of ADMT for assessing consumers. Consumers will have access to information such as the justification for use of ADMT along with the actual outcome and the decisionmaking process involving the use of ADMT. If such a decision relates to denial of “goods or services,” such as an employment opportunity, a consumer must be educated about their access rights.

While these regulations are yet to be finalized, they give a glimpse as to how the final regulations will govern the use of automated technology including A.I.