One rule · checked 19 October 2026

Automated decisions about jobs, pay or loans? California's deadline is 1 January 2027.

The CCPA rules on automated decisionmaking technology (ADMT) took effect on 1 January 2026. A business that already uses ADMT for a significant decision must comply by 1 January 2027.

The short version

The CCPA's new rules cover software that replaces, or mostly replaces, a human decision about someone's job, pay, loan, housing, school or healthcare.

If you already use it, you have until January 1, 2027. Then people get a notice first, and usually a way to opt out.

Exception: it only covers CCPA businesses. That's revenue over about $26.6 million, or a big trade in personal data.

In numbers

A business is covered by the CCPA if it meets any one of these tests
TestThreshold
Annual gross revenue in the preceding calendar yearOver $26,625,000 (from 1 January 2025)
Buys, sells or shares personal information100,000 or more consumers or households a year
Revenue from selling or sharing personal information50% or more of annual revenue

Sources

Checked on 19 October 2026.

The notice before use is in section 7220 and the opt-out is in section 7221, which lists exceptions such as a human appeal. The revenue threshold changes every two years; the next change is due on 1 January 2027.

Watch

Psst posts every video on these channels.

Psst is made by Zain Ali, who founded ivector, a software company.