California Privacy Protection Agency announced draft regulations around automated decision-making technologies (ADMT). A quick summary below-

When will you be covered?

Businesses using ADMT in the following ways will be covered-

• For decisions that tend to have the most significant impacts on consumers’ lives. This would include, for example, decisions about their employment or compensation.
• Profiling an employee, contractor, applicant, or student. This would include, for example, using a keystroke logger to analyze their performance, and tracking their location.
• Profiling consumers in publicly accessible places, such as shopping malls, medical offices, and stadiums. This would include, for example, using facial recognition technology or automated emotion assessment to analyze consumers’ behavior.
• Profiling a consumer for behavioral advertising. This would include, for example, evaluating consumers’ personal preferences and interests to display advertisements to them.

New Consumer Protection on the Use of ADMT

For the above uses of ADMT, the draft regulations would provide consumers with the following protections:

• Businesses would be required to provide “Pre-use Notices” to inform consumers about how the business intends to use ADMT so that the consumer can decide whether to opt-out or to proceed, and whether to access more information.
• The ability to opt out of the business’s use of ADMT (except in certain cases, such as to protect life and safety).
• The ability to access more information about how the business used ADMT to decide on the consumer.

Other Requirements: These draft requirements would also require risk assessments that the Board is considering at the December 8, 2023 meeting.

Conclusion: These proposed frameworks will provide consumers control over their personal information while ensuring that automated decision-making technologies, including those made from artificial intelligence, are used with privacy in mind and design.