What's Happening?
The California Privacy Protection Agency (CPPA) has finalized new regulations under the California Consumer Privacy Act (CCPA) concerning the use of automated decision-making technology (ADMT) in employment contexts. These regulations, finalized on July 24, 2025, aim to address the legal challenges posed by AI technologies that process personal information to replace or substantially replace human decision-making. The regulations cover tools used for application screening, performance evaluation, productivity monitoring, and other employment-related decisions. A significant aspect of these regulations is the requirement for businesses to maintain oversight of third-party vendors using ADMT, ensuring compliance with privacy obligations. Employers must also provide notice to employees and job applicants about the use of ADMT, detailing its purpose, functionality, and the rights of individuals to opt out. These notice requirements must be met by January 1, 2027.
AD
Why It's Important?
The finalization of these regulations marks a critical step in the evolving landscape of AI governance, particularly in employment. By setting clear guidelines, California is leading efforts to ensure that AI technologies are used responsibly and transparently in the workplace. This move is significant for businesses as it imposes new compliance requirements, potentially affecting operational processes and legal liabilities. Companies that fail to adhere to these regulations may face legal challenges, impacting their reputation and financial standing. The regulations also empower employees and job applicants by providing them with greater transparency and control over how their personal information is used in employment decisions.
What's Next?
The regulations are subject to a 30-day review process by the Office of Administrative Law. If approved, businesses will need to adapt their practices to comply with the new requirements. This includes conducting risk assessments to balance privacy risks against the benefits of using ADMT. Companies are advised to engage legal counsel to navigate these changes and ensure compliance. Additionally, a webinar hosted by CDF’s Privacy and AI Practice Group is scheduled for August 20 to discuss these developments and their implications for employers.
