Can consumers opt out of automated decisionmaking under the CCPA?

California now has an automated decisionmaking rule of its own, and it works differently from the European one. The CCPA's ADMT regulations took effect on January 1, 2026, but section 7200(b) gives businesses until January 1, 2027 to comply. A business already using ADMT for a significant decision before that date must be compliant by it; one that starts later must be compliant from the moment it starts.

What the opt-out right actually covers

Section 7221(a) requires a business to provide consumers with the ability to opt out of the use of ADMT to make a significant decision concerning the consumer, except as set out in 7221(b). Two defined terms carry all the weight.

ADMT, under section 7001(e), is any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking. To substantially replace human decisionmaking means the business uses the technology's output to make a decision without human involvement.

A significant decision, under section 7001(ddd), is a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Each of those is then defined. Financial or lending services means extension of credit or a loan, transmitting or exchanging funds, deposit or checking accounts, check cashing, or installment payment plans. Education enrollment or opportunities means admission or acceptance into academic or vocational programs, educational credentials, and suspension and expulsion. Employment covers hiring, allocation or assignment of work and compensation, promotion, and demotion, suspension and termination. Healthcare services means services related to the diagnosis, prevention or treatment of human disease or impairment, or the assessment or care of an individual's health.

Section 7001(ddd)(6) closes the definition with a single sentence that decides the question for a large share of businesses: significant decision does not include advertising to a consumer. Automated ad targeting is not an ADMT significant decision. It may still be selling or sharing, which brings its own opt-out duty, but it is not this one.

The human-appeal alternative

Most businesses that use ADMT for hiring or lending will not offer an opt-out. They will build the appeal route instead, because section 7221(b)(1) removes the opt-out duty where a business provides a method to appeal the decision to a human reviewer with authority to overturn it.

The conditions are specific. Under 7221(b)(1)(A), the business must designate a human reviewer to review and analyze the ADMT output and any other information relevant to changing the decision. That reviewer must consider the information the consumer provided in support of the appeal, must know how to interpret and use the ADMT output, and must have authority to change the decision based on their analysis. Under 7221(b)(1)(B), the business must clearly describe how to submit an appeal, enable the consumer to provide supporting information, keep the method easy to execute with minimal steps, and verify the consumer under Article 5.

A rubber-stamp review will not qualify. The regulation requires competence, authority and genuine consideration of what the consumer submits.

The other two exceptions are narrower. Section 7221(b)(2) covers admission, acceptance or hiring decisions and 7221(b)(3) covers allocation or assignment of work and compensation, each available only where the business uses the ADMT solely for assessing the consumer's ability to perform at work or in an educational program, or solely for that allocation, and where the ADMT works for the business's purpose and does not unlawfully discriminate based on protected characteristics.

How the opt-out has to be offered

Section 7221(c) requires two or more designated methods for submitting opt-out requests, chosen with regard to how the business interacts with consumers, how it uses the ADMT and ease of use. At least one method must reflect how the business primarily interacts with the consumer.

A business that interacts with consumers online must at minimum provide an interactive form reached from an opt-out link in the Pre-use Notice, and 7221(c)(1) specifies that the link title must state what the consumer is opting out of, such as "Opt-out of Automated Decisionmaking Technology." Section 7221(c)(4) rules out relying on a cookie banner or cookie controls, because cookies concern collection of personal information rather than the use of ADMT.

Sections 7221(e) and (f) remove the usual friction. A business must not require the consumer to create an account or provide information beyond what is necessary to direct the business to opt them out, and must not require a verifiable consumer request. Where the business can comply without additional information, it must. Section 7221(g) allows denial only on a good-faith, reasonable and documented belief that the request is fraudulent, and the business must tell the requester why.

The Pre-use Notice comes first

Section 7220(a) requires a Pre-use Notice informing consumers about the business's use of ADMT and their rights to opt out and to access it. Under 7220(b)(2) it must be presented prominently and conspicuously at or before the point the business collects the personal information it plans to process using the ADMT. A business may fold it into the Notice at Collection, provided that notice carries the required information.

Notice therefore precedes the decision, not the model. Planning to run an applicant's data through a scoring model means telling them before you collect it.

How this compares to GDPR Article 22

The European rule under Article 22 starts from a prohibition on solely automated decisions with legal or similarly significant effects, then permits them on three grounds. California starts from permission and attaches an opt-out, with a defined list of decision types rather than an effects test. A business operating on both sides can often satisfy both with one human-review process, but the scoping work is different: Europe asks how significant the effect is, California asks which listed category the decision falls into.

Next step

If you automate hiring, lending, pricing or eligibility decisions, the free 2-minute Obligation Scan flags which California duties reach you and what each one needs. The US state privacy law hub sets the rest of the CCPA obligations in order.