CCPA and AI agents that make decisions about consumers

California's privacy law, the CCPA as amended by the CPRA, reaches AI agents that make significant decisions about consumers, such as on lending, housing, jobs, education or healthcare, or that largely replace the people who make them. Rules on automated decision-making add notices, opt-out and access rights and risk assessments on top of the core consumer rights.

What does the CCPA require for automated decisions, in plain words?

The CCPA gives California consumers rights over their personal information: to know what is collected, to access it, to delete and correct it, to opt out of its sale or sharing, and to limit the use of sensitive information. The CPRA amendments directed California's privacy regulator to make rules on automated decision-making technology, including profiling.

Those rules, in substance, apply when a business uses technology that replaces or substantially replaces human decision-making for a significant decision about a consumer. They require a notice before use explaining the purpose and how the technology works, a right to opt out in many cases, a right to access information about how it was used in a decision about you, and risk assessments for higher-risk processing. The rules have phased compliance dates, so check the current text for when each part applies.

For the broader privacy picture, see CCPA and CPRA: AI agents and California consumers.

Who does it apply to?

For-profit businesses that do business in California and meet the law's thresholds on revenue or on the volume of personal information they handle, along with businesses whose revenue comes largely from selling or sharing it. The rules protect California residents, including employees and job applicants.

There is an important carve-out for financial services. Personal information collected and processed under GLBA is largely exempt from the CCPA, as is information regulated by federal credit reporting law. A bank's credit decision built on GLBA-covered data may therefore fall mostly outside the CCPA's automated decision rules, while still being subject to ECOA and Regulation B's duty to give specific reasons for denial. Non-bank lenders, landlords, employers and health businesses outside HIPAA are more squarely inside. Whether the CCPA reaches your agent at all is covered in does the CCPA cover AI agents.

When does an agent's involvement count as automated decision-making?

The deciding question is whether the agent replaces or substantially replaces a person in making the decision. Agents make this harder to answer than models, because they do more of the work.

Consider an agent screening rental applications. It reads income documents, checks references and drafts a recommendation. If a leasing manager reads the file, understands the recommendation, can change it and actually decides, a person is making the decision. If the manager approves recommendations in bulk without looking, the agent has substantially replaced them.

So the line is drawn by the quality of human involvement. The reviewer must know how to interpret the agent's output, review the underlying information and have authority to decide differently. The same test applies in Europe; see GDPR Article 22 and AI agents that make decisions and where agents cross the line under GDPR.

How do you meet the rules for agents that decide?

What will a regulator or auditor ask?

• Which of your agents take part in significant decisions about California consumers?
• For each, does a person meaningfully decide, or does the agent?
• Show us the pre-use notice and where consumers see it.
• How many consumers opted out, and what happened to their applications?
• If a consumer asks how the agent was used in their decision, what do you tell them?
• What data exemptions are you relying on, and for which agents?

What does the CCPA not cover?

It does not cover most GLBA-regulated financial data. It does not replace federal anti-discrimination and fair lending law. It does not set an AI risk-tier system like the EU's. And it is one state's law: Colorado has passed an AI act aimed at high-risk systems making consequential decisions, and other states have their own privacy laws, so map each. If you also operate in Europe, compare the requirements with whether GDPR allows agents to make automated decisions. For the full map, see AI agent regulation mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Pryme keeps decision capabilities at depth 2 unless evidence supports more, so a named person decides and the record shows what they reviewed and changed. Each fact the agent used is filed with its provenance, which gives you the material to answer a consumer's access request about how the agent was used in their decision.