/>iThis week, the California Privacy Protection Agency (CPPA) board held its April meeting to discuss the latest set of proposed regulations, including automated decision-making technology (ADMT) regulations. Instead of finalizing these rules, the board continued its debate and considered further amendments to the draft regulations. Notably, some members proposed changing the definition of ADMT and removing behavioral advertising from ADMT and risk assessment requirements. The board also directed the CPPA to remove a selection of categories in scope for provisions covering significant decisions. The board conditionally approved these changes, but the final (we think) vote will occur at the next meeting.
These continued discussions likely mean that the final rules related to ADMT, risk assessments, and cybersecurity audits are still a long way away. The CPPA raised six topics that they want additional feedback on before presenting the final set of amendments next month:
1. The definition of “ADMT;”
2. The definition of “significant decision;”
3. The “behavioral advertising” threshold;
4. The “work or educational profiling” and “public profiling” thresholds;
5. The “training” threshold; and
6. Risk assessment submissions to the CPPA.
If the changes are substantial enough, the CPPA would open up another 45-day comment period. During the last comment period, CPPA staff reported that over 1,600 pages of comments were received, and hours of testimony were given during the public hearing. The board has until November 2025 to submit the final regulatory package to the California Office of Administrative Law.
Board member Alastair Mactaggart argues that the draft regulations go beyond the scope of the CPPA’s authority to regulate privacy by also attempting to regulate artificial intelligence. He said, “We are now on notice that if we pass these regulations, we will be sued repeatedly and by many parties.” We will continue to monitor these discussions and proposed regulations.
