1. (a) A business that uses ADMT as set forth in section 7200, subsection (a), must provide consumers with a Pre-use Notice. The Pre-use Notice must inform consumers about the business's use of ADMT and consumers' rights to opt-out of ADMT and to access ADMT, as set forth in this section. A business may provide a Pre-use Notice in its Notice at Collection, provided that the Notice at Collection complies with, and includes the information required by, subsections (b) and (c).

2. (b) The Pre-use Notice must:

   1. (1) Comply with section 7003, subsections (a)-(b).
   2. (2) Be presented prominently and conspicuously to the consumer at or before the point when the business collects the consumer's personal information that the business plans to process using ADMT. If a business has already collected the consumer's personal information for a different purpose and subsequently plans to process it using ADMT for the purpose set forth in section 7200, subsection (a), the business must provide a Pre-use Notice before processing the consumer's personal information for that purpose.
   3. (3) Be presented in the manner in which the business primarily interacts with the consumer.

3. (c) The Pre-use Notice must include the following:

   1. (1) A plain language explanation of the specific purpose for which the business plans to use the ADMT. The business must not describe the purpose in generic terms, such as “to make a significant decision” without further information, because this does not describe to the consumer the specific decision for which the business plans to use ADMT with respect to them.

   2. (2) A description of the consumer's right to opt-out of ADMT and how the consumer can submit a request to opt-out of ADMT.

      1. (A) If the business is not required to provide the ability to opt-out because it is relying upon the human appeal exception set forth in section 7221, subsection (b)(1), the business must instead inform the consumer of their ability to appeal the decision and provide instructions to the consumer on how to submit their appeal.
      2. (B) If the business is not required to provide the ability to opt-out because it is relying upon another exception set forth in section 7221, subsection (b), the business must identify the specific exception it is relying upon.
   3. (3) A description of the consumer's right to access ADMT with respect to the consumer and how the consumer can submit their request to access ADMT to the business.
   4. (4) That the business is prohibited from retaliating against consumers for exercising their CCPA rights.

   5. (5) Additional information about how the ADMT works to make a significant decision about consumers, and how the significant decision would be made if a consumer opts out. The business may provide this information via a simple and easy-to-use method (e.g., a layered notice or hyperlink). The additional information must include a plain language explanation of the following:

      1. (A) How the ADMT processes personal information to make a significant decision about consumers, including the categories of personal information that affect the output generated by the ADMT. An “output” may include predictions, decisions, and recommendations (e.g., numerical scores of compatibility).
      2. (B) The type of output generated by the ADMT, and how that output is used to make a significant decision. For example, this may include whether the output is the sole factor in the decisionmaking process or what the other factors are in that decisionmaking process; and to the extent that a human is part of the decisionmaking process in a manner that does not meet the requirements of “human involvement” in section 7001, subsection (e)(1), what that human's role is in the decisionmaking process.
      3. (C) What the alternative process for making a significant decision is for consumers who opt out, unless an exception to providing the opt-out of ADMT set forth in section 7221, subsection (b), applies.

4. (d) In providing the information required by subsection (c)(5), a business's Pre-use Notice is not required to include:

   1. (1) Trade secrets, as defined in Civil Code section 3426.1, subdivision (d); or

   2. (2) Information that would compromise the business's ability to:

      1. (A) Prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information;
      2. (B) Resist malicious, deceptive, fraudulent, or illegal actions directed at the business or at consumers, or to prosecute those responsible for those actions; or
      3. (C) Ensure the physical safety of natural persons.

5. (e) A business may provide a consolidated Pre-use Notice as set forth below, provided that the consolidated Pre-use Notice includes the information required by this Article for each of the business's proposed uses of ADMT:

   1. (1) The business's use of a single ADMT for multiple purposes. For example, an employer may provide a consolidated Pre-use Notice to an employee that addresses the employer's proposed use of productivity monitoring software to determine the employee's allocation/assignment of work and compensation, and to determine which employees will be demoted.
   2. (2) The business's use of multiple ADMTs for a single purpose. For example, a business may provide a consolidated Pre-use Notice to a job applicant that addresses the business's proposed use of: (1) software to screen applicants' resumes to determine which applicants it will hire, and (2) software to evaluate applicants' vocal intonation, facial expression, and gestures to determine which applicants to hire.
   3. (3) The business's use of multiple ADMTs for multiple purposes. For example, an educational provider may provide a consolidated Pre-use Notice to a new student that addresses the educational provider's proposed use of: (A) software that automatically screens students' work for plagiarism to determine whether they will be suspended, and (B) software that automatically assesses students' exams to determine whether to grant them a diploma or certificate.
   4. (4) The systematic use of a single ADMT. For example, a business may provide a consolidated Pre-use Notice to an employee that addresses the business's methodical and regular use of ADMT to allocate work to its employees, rather than providing a Pre-use Notice to the same employees each time it proposes to use the same ADMT for the same purpose.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Section 1798.185, Civil Code.

History

1. New section filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).