On November 8, 2024, the California Privacy Protection Agency (CPPA) voted to advance proposed regulations concerning automated decisionmaking technology. While the comment period is ongoing and we do not have final rules, we are taking a look at some key provisions to help businesses begin to assess the potential effects of these rules if made final as is. In this post, we look at what “automated decisionmaking technology” means.

What is automated decisionmaking technology (ADMT)?

According to the proposed regulation, automated decisionmaking technology (ADMT) would mean:  

any technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking.

So, the first thing to note is that, for purposes of these proposed regulations, an ADMT under the CCPA proposed rules must involve the processing of personal information. Under the CCPA, however, while personal information is defined broadly, there are several exceptions. One is that neither deidentified nor aggregate consumer information constitute personal information. Another is protected health information covered by the Health Insurance Portability and Accountability Act (HIPAA) is not considered personal information. And, there are other exceptions to consider.

Understanding these exceptions may help business narrow the impact of these regulations on their organizations. For example, technology facilitating human decisionmaking to process claims under a HIPAA-covered group health plan might fall outside of these regulations.

The proposed regulations also would define what it means to “substantially facilitate human decisionmaking.” We encounter a similar concept in some other AI regulation, such as Local Law 144 in New York City and the Colorado Artificial Intelligence Act (CAIA). Under these proposed regulations, if the technology’s output is a key factor in a human’s decisionmaking, it will be considered to be substantially facilitating human decisionmaking. The proposed regulations provide the following example,

using automated decisionmaking technology to generate a score about a consumer that the human reviewer uses as a primary factor to make a significant decision about them.

(emphasis added). Note the score need not be “the” primary factor, only “a” primary factor. Perhaps this will be clarified in the final rule. But one can read this language as similar to the “substantial factor” description when assessing “high-risk artificial intelligence systems” under the CAIA. However, under the NYC law, substantially assisting or replacing discretionary decisionmaking requires relying solely on the output, weighting the output more than any other factor, or using the output to overrule conclusions derived from other factors including human decision-making. This is a small but potentially significant distinction affecting the potential application of AI regulation across jurisdictions that organizations will have to track.

ADMTs Include Profiling

The proposed regulations would make clear that ADMTs include profiling, defined as:

any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s intelligence, ability, aptitude, performance at work, economic situation; health, including mental health; personal preferences, interests, reliability, predispositions, behavior, location, or movements.

Over the last few years, many employers have deployed a range of devices and applications that may include “technologies” (under the proposed regulations – “software or programs, including those derived from machine learning, statistics, other data-processing techniques, or artificial intelligence”) that may constitute “profiling.” These devices and applications help support employers’ efforts to source, recruit, monitor, track, and assess the performance of employees, applicants, and others. Examples include (i) dashcams deployed throughout company fleets to promote safety, improve performance, and reduce costs, and (ii) performance management platforms that, among other things, are used to evaluate employee productivity.

Technologies that are NOT ADMTs

Technologies that do not execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking would not be ADMTs, according to the proposed regulations, such as: web hosting, domain registration, networking, caching, website-loading, data storage, firewalls, anti-virus, anti-malware, spam- and robocall-filtering, spellchecking, calculators, databases, spreadsheets, or similar technologies.

Businesses would need to be careful applying these exceptions. Using a spreadsheet to run regression analyses on top-performing managers to determine their common characteristics which then are used to make promotion decisions concerning more junior employees would be a use of an ADMT. That would not be the case if the spreadsheet were merely used to tabulate final scores on performance evaluations.

There certainly will be more to come concerning the regulation of AI, including under the CCPA. Organizations using these technologies will need to monitor these developments.