California CPPA Adopts Final ADMT Regulations as Netherlands Issues Human Intervention Guidance

Want to receive these privacy recaps in your inbox each week? Subscribe here.

United States

CPPA Adopts ADMT Regulations Without Substantive Revision

The California Privacy Protection Agency (CPPA) unanimously voted, during its July 24 board meeting, to adopt regulations governing automated decisionmaking technology (ADMT) without any substantive changes from the version posted by the CPPA in May 2025. Assuming the ADMT regulations (which also include regulations governing risk assessments, cybersecurity audits and application of the CCPA to insurance companies) are filed with the Office of Administrative Law by August 31, 2025, they will technically become effective October 1, 2025; however, per the latest text of the regulations, businesses will not be required to comply with the obligations specific to ADMT until January 1, 2027.

TAKEAWAY

Although the final ADMT regulations are significantly narrower in their scope and requirements than the draft regulations initially proposed in November 2023, they still present new requirements for companies within scope of the regulations. Specifically, companies engaging in profiling or any other automated decisionmaking technology (i.e., in summary, decisionmaking through technical computation using personal information without a human reviewing, analyzing, and having the ability to change the output) (“ADMT”) to make a significant decision concerning a consumer (i.e., for certain financial, lending, housing, education, employment, or healthcare purposes, but not for advertising) will be required to: (1) provide consumers with a pre-use notice that includes a description of the use of ADMT, the specific purpose for which it will be used, what personal information will impact the outcome, how the decision will be made if the consumer does or does not opt out, the type of output generated, as well as the consumer’s rights with respect to ADMT and a link through which consumers can opt out of the use of ADMT; (2) extend to consumers rights to access (i.e., receive information about) ADMT and appeal the business’s use of ADMT; (3) specify in their privacy policy the consumer’s right to opt out of and access ADMT, (4) conduct risk assessments according to detailed requirements set out in the regulations and submit to the agency certain information from the risk assessment; and (5) include annual metrics regarding requests to access and opt out of ADMT in their published consumer request reporting (if meeting the thresholds required to disclose request metrics). The new regulations also include cybersecurity audit requirements for certain businesses, as well as risk assessment requirements (applicable beyond just ADMT) and regulations regarding the application of CCPA to insurance companies. 

Europe

Netherlands DPA Issues ADMT Guidance

One day before the California CPPA adopted regulations governing automated decisionmaking technology (see above), the Dutch data protection authority published guidance on the same topic, stating that “people have the right to human intervention in algorithmic decisions that affect them and have consequences for them”.

TAKEAWAY

Article 22 of the GDPR prohibits automated decision-making (including profiling) “which produces legal effects concerning him or her or similarly significantly affects him or her” without explicit consent or another exception (i.e., where necessary to perform a contract or authorised by law). Even in the case of consent or where the decision-making is necessary to perform a contract, the data controller is required under the GDPR to implement measures to safeguard the data subject’s rights, freedoms and legitimate interests, including the right to obtain human invention and to contest the decision. The European Data Protection Board (EDPB) has also issued guidelines on automated decision-making and profiling, clarifying that if a human reviews and takes account of other factors (in addition to the recommendations from automated process) in making the final decision, Article 22 would not apply, but that such human involvement must be meaningful, rather than a token gesture. The purpose of the Dutch guidance (as outlined in the introduction) is to provide a tool for those who design and implement human intervention within an organization, including guidance on what it means for human intervention to be meaningful. 

A LITTLE MORE PRIVACY, IF YOU PLEASE

• Texas AG Outlines Data Privacy Actions Over the Last Year
• Judge Refuses Dismissal of Claims Against Criteo / Meta / Google in GoodRX Class Action
• CNIL Finalizes AI Recommendations

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.