California Privacy Agency Releases Draft Rules for Automated Decision-Making Technology, Including Opt-Out for Behavioral Ads

The California Privacy Protection Agency (CPPA) yesterday published draft regulations implementing the California Consumer Privacy Act’s restrictions on the commercial use of automated decision-making systems. The regulations would require businesses to notify consumers about their use of such technology and to respond in plain language to consumers’ requests for information about automated systems and decisions. The regulations would also provide consumers with the ability to opt out of many uses of automated decision-making, including high-impact decisions, profiling of employees and students, profiling in public places, and profiling for the purposes of behavioral advertising. The regulations would impose additional rules for behavioral advertising involving minors, including an opt-in process and a parental consent requirement for children under 13 years old. The CPPA Board will discuss the draft rules on December 8 and is expected to release the regulations for public comment in the coming months.

EPIC regularly files comments and advocates in public hearings before the CPPA. EPIC provided extensive input on CCPA regulations in November 2021, May 2022, August 2022, November 2022, and March 2023, arguing for consumer-friendly interpretations of the CCPA to guard against exploitative commercial data practices. Recently, EPIC published an analysis of the CPPA draft regulations involving risk assessments. The CPPA’s latest draft rules coincide with momentum at the federal level to regulate AI.