California appears to be changing its approach to how it regulates artificial intelligence, likely reflecting its reaction to challenges seen recently in other states. Namely, the California Privacy Protection Agency recently released an update to its draft regulations which change how the Agency plans to regulate Automated Decisionmaking Technology, or ADMT. This comes after the Agency’s original proposal faced intense opposition from industry groups, state lawmakers and Governor Newsom.
The public has until June 2, 2025 to submit comments. As now proposed, some of the key changes include:
- Narrowed scope of ADMT rules: The definition of automatic decision-making technologies would now only cover technologies that “replace or substantially replace human decision-making.” Technologies that just help or support human decisions would not be covered. The update also makes clear that the ADMT rules would only apply to decisions that result in a “significant decision” about a consumer—like those involving housing, employment, credit, or access to essential goods and services. Advertising to a consumer is specifically excluded from what counts as a “significant decision.”
- Eased risk assessment burden: The new rules would make it easier for businesses when it comes to conducting risk assessments. For example, profiling a consumer for behavioral advertising would no longer requires a risk assessment. Similarly, using personal data to train ADMT would not trigger a risk assessment unless the business does it intentionally for certain specific purposes.
- Cybersecurity audits: As revised, businesses would have more time to complete initial audits, depending on how much money they make. Some of the tougher rules have also been relaxed. For example, businesses can use existing audits and report the results up to executive management instead of the board of directors.
Putting it into Practice: While we await the final regulations, this is nonetheless a reminder for businesses to review their uses of automatic decisionmaking technologies.