Coalition Comment to the CPPA on Rulemaking on Risk Assessments, Cybersecurity, and ADMTs

California Privacy Protection Agency
2101 Arena Boulevard
Sacramento, CA 95834

Dear Board Members, Executive Director, and Agency Staff,

We write in response to the California Privacy Protection Agency’s (“CPPA” or “the Agency”) request for comment on the Agency’s proposed Risk Assessment and Automated Decisionmaking Technology (“ADMT”) Regulations (“Proposed Regulations”) under the California Consumer Protection Act (“CCPA”).

The revised draft regulations released on May 9, 2025 represent significant concessions by the Agency and its board to a campaign of industry pressure. In November of 2020, Californians voted for a privacy law that promised to put in place regulations that would give them meaningful rights to control how their personal information was used, including in automated and algorithmic systems. With the most recent draft regulations, the Agency is poised to deprive Californians of the benefit of one of the most important provisions of the state’s privacy law. We urge the Agency to reverse course.

In this letter, we address three key changes to the draft regulations: First, the narrowed definition of ADMT. Second, the removal of “criminal justice” related decisions from the definition of “significant decision.” And third, the removal of the prohibition on processing personal information when the risks outweigh the benefits.

The Narrowed Definition of ADMT Threatens to Undermine the Core Purpose of the CCPA’s ADMT Regulations

In our February comments we emphasized the importance of preserving a definition of “Automated Decisionmaking Technology” that protected people against the harm that ADMTs were causing today.[1] Our concern with the previous draft was that it was limited to algorithmic systems that “execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking.”[2] As we explained in those comments, companies will have a strong incentive to characterize their systems as providing only one input of many to a human—thus making it arguably not a “key factor” in the decision—but nevertheless create implicit policies that make clear to the human decision-makers that the automated factor is the one to be trusted.[3]

The changes made in the most recent draft go even farther than allowing companies to self-certify that they should not be subject to regulation: it explicitly carves out ADMTs where a human has even glancing involvement in making the decision. Under this new narrower standard, many more consumers will be denied the notice and opt-out protections they need and deserve. The definition of ADMT, which by statute must include instances where people’s behavior and performance at work are predicted[4], therefore falls short of that proper scope.

Cutting “Criminal Justice” from the Definition of “Significant Decision” Will Harm the Most Vulnerable Californians.

The revised draft regulations also eliminate “criminal justice” from the definition of a “significant decision.”[5] In our February 2025 comments, we highlighted that the inclusion of “criminal justice” should be expanded to include a variety of decisions that are among the most impactful that a government can make on a person’s life. These include algorithmically driven pretrial risk assessments, sentencing and parole decisions, and Our letter recommended including the following detailed definition of significant decisions in the “criminal justice” area.

1. Risk assessments for pretrial decisionmaking, including, but not limited to, decisions related to pretrial detention, release on one’s own recognizance, the granting or setting of monetary bail, and the conditions of pretrial release;
2. Sentencing;
3. Parole;
4. Probation and any other form of supervised release;
5. Deployment of law enforcement resources;
6. Decisions related to conditions of confinement, including, but not limited to, housing, classification, and programming.

The elimination of criminal justice from the definition of “significant decision” opens the door to a panoply of tech-mediated cruelty by the criminal legal system, from keeping people incarcerated to swarming already overpoliced neighborhoods with more officers. The CCPA’s promise was to give people meaningful control over how their information was used. That meaningful control is not realized through the ministerial management of records in a database. It requires that systems that operate through the processing of people’s personal information be modified to ensure that the people have some measure of power over how those systems impact their liberty, their communities, and their lives. Cutting the definition of “significant decision” to eliminate decisions that are part of the criminal legal system deprives some of the most vulnerable Californians of autonomy and privacy when they need it most.

The Regulations Should Direct That Processing Where the Risks Outweigh the Benefits is Restricted or Prohibited.

Risk assessments are required by the CCPA for a simple reason: when the risks to privacy of processing of consumers’ personal information outweigh the benefits, the processing should be restricted or prohibited outright. As the statute makes explicit, risk assessments weigh the risks “with the goal of restricting or prohibiting such processing if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public.”[6]

The CCPA requires, and Californians are entitled to expect, that risk assessments include the company’s actual weighing of risks and benefits, and that the regulatory “goal” is “restricting or prohibiting” such processing if the specified risks outweigh the benefits.[7] It is not enough to simply list various risks and benefits and assert that the risks are outweighed.

The November 2024 draft regulations included an explicit prohibition on processing personal information when the specified risks outweigh the benefits, but that language was removed in the most recent draft.[8] Instead of prohibiting the processing, the regulations merely recite the language of the statute regarding the goal of the regulations. This is inadequate.

Imagine a processing activity that risks significant harm to vulnerable consumers—like people searching for housing or employment—but which is marginally profitable for a business. When a business self-certifies that the processing’s benefits outweigh the costs, it is the Agency’s role under the statute to review that certification and the supporting analysis and determine independently whether the business has, under the law, properly performed the cost-benefit analysis. If the business’s assessment is inconsistent with the law, then the processing, in the language of the statute, must be restricted or prohibited.

Conclusion

We urge the Agency to take the steps recommended in these comments to ensure that consumers’ privacy rights are protected.

Sincerely,

Jacob Snow
Senior Staff Attorney
ACLU of Northern California

Carmen-Nicole Cox
Director of Government Affairs
ACLU California Action

Ben Winters
Director of AI and Data Privacy
Consumer Federation of America

Emory Roane
Associate Director of Policy
Privacy Rights Clearinghouse

Sara Geoghegan
EPIC Senior Counsel
Electronic Privacy Information Center

Lee Tien
Legislative Director and Adams Chair for Internet Rights
Electronic Frontier Foundation

[1] Coalition Comments on Proposed Risk Assessments and Automated Decisionmaking Technology Regulations, February 19, 2025, pp. 5-6, https://www.aclunc.org/sites/default/files/2025-02-19%20ACLU%20CA%20Action%20EPIC%20EFF%20CFA%20PRC%20CPPA%20Comments.pdf.

[2] Id.

[3] Id. at 6.

[4] Civil Code § 1798.185(a)(16).

[5] Compare CA PRIVACY PROTECTION AGENCY – MODIFIED TEXT OF PROPOSED REGULATIONS, May 9, 2025, Section 7150(b)(3) (cutting entire definition of “significant decision” that includes “criminal justice (e..g., posting of bail bonds).”) with Section 7001(ddd) (new definition of “significant decision” that does not mention decisions that arise in the criminal justice system, or that impact a person’s physical liberty.). https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_mod_txt_pro_reg.pdf

[6] Civil Code § 1798.185(a)(15)(B) (emphasis added).

[7] Id.

[8] May 9, 2025 Draft Regulations, § 7154 (showing changes from previous draft striking language requiring that the “business must not process personal information for any processing activity” if the risks outweigh the benefits.”).