California Amends CCPA: New Rules for AI-Driven Profiling and Automated Decision-Making

CCPA Amendments Target AI

California Governor signed into law significant amendments to the California Consumer Privacy Act (CCPA), introducing comprehensive new requirements for businesses that use artificial intelligence-driven profiling and automated decision-making systems. These amendments represent the most detailed AI-specific privacy regulations in the United States.

New Requirements

The amendments require businesses to provide consumers with meaningful information about how AI systems make decisions that significantly affect them, including in areas such as employment, housing, insurance, and credit. Companies must also conduct regular algorithmic impact assessments and make the results available to the California Privacy Protection Agency.

Consumer Rights Expanded

Consumers now have the right to opt out of AI-driven profiling, request human review of automated decisions, and access the specific data inputs used in decisions affecting them. The amendments also prohibit the use of AI systems that discriminate based on protected characteristics.

Compliance Timeline

Businesses have until January 2027 to comply with the new requirements, giving them approximately one year to audit their AI systems, implement consent mechanisms, and establish human review processes.