1. (a) Every business whose processing of consumers' personal information presents significant risk to consumers' privacy as set forth in subsection (b) must conduct a risk assessment before initiating that processing.

2. (b) Each of the following processing activities presents significant risk to consumers' privacy:

   1. (1) Selling or sharing personal information.

   2. (2) Processing sensitive personal information.

      1. (A) A business that processes the sensitive personal information of its employees or independent contractors solely and specifically for purposes of administering compensation payments, determining and storing employment authorization, administering employment benefits, providing reasonable accommodation as required by law, or wage reporting as required by law, is not required to conduct a risk assessment for the processing of sensitive personal information for these purposes. Any other processing of consumers' sensitive personal information is subject to the risk-assessment requirements set forth in this Article.
   3. (3) Using ADMT for a significant decision concerning a consumer.
   4. (4) Using automated processing to infer or extrapolate a consumer's intelligence, ability, aptitude, performance at work, economic situation, health (including mental health), personal preferences, interests, reliability, predispositions, behavior, location, or movements, based upon systematic observation of that consumer when they are acting in their capacity as an educational program applicant, job applicant, student, employee, or independent contractor for the business.
   5. (5) Using automated processing to infer or extrapolate a consumer's intelligence, ability, aptitude, performance at work, economic situation, health (including mental health), personal preferences, interests, reliability, predispositions, behavior, or movements, based upon that consumer's presence in a sensitive location. “Infer or extrapolate” does not include a business using a consumer's personal information solely to deliver goods to, or provide transportation for, that consumer at a sensitive location.
   6. (6) Processing the personal information of consumers, which the business intends to use to train an ADMT for a significant decision concerning a consumer; or train a facial-recognition, emotion-recognition, or other technology that verifies a consumer's identity, or conducts physical or biological identification or profiling of a consumer. For purposes of this paragraph, “intends to use” means the business is using, plans to use, permits others to use, plans to permit others to use, is advertising or marketing the use of, or plans to advertise or market the use of.

3. (c) Illustrative examples of when a business must conduct a risk assessment follow:

   1. (1) Business A is hiring a new employee. Business A plans to videotape job interviews, then use emotion-recognition technology without human involvement to decide who to hire. Business A must conduct a risk assessment because it plans to use ADMT for a significant decision concerning a consumer.
   2. (2) Business B provides a mobile dating application. Business B plans to disclose consumers' precise geolocation and the ethnicity and medical information the consumers provided in their dating profiles to Business B's analytics service provider. Business B must conduct a risk assessment because it plans to process sensitive personal information of consumers.
   3. (3) Business C provides a personal-budgeting application into which consumers enter their financial information, including income. Business C plans to display advertisements to these consumers on different websites for payday loans that are based on evaluations of these consumers' personal preferences, interests, and reliability from their financial information. Business C must conduct a risk assessment because it plans to share personal information.
   4. (4) Business D is a technology provider. Business D plans to extract faceprints from consumers' photographs to train Business D's facial-recognition technology. Business D must conduct a risk assessment because it plans to process consumers' personal information to train a facial-recognition technology.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Section 1798.185, Civil Code.

History

1. New article 10 (sections 7150-7157) and section filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).