CCPA and CPRA: AI agents and California consumers

Every AI agent that touches California consumers' personal information falls under the CCPA as amended by the CPRA. The business must give notice at collection, keep agent processing necessary and proportionate, limit sensitive data, bind agent vendors as service providers, honour access, deletion and correction requests across everything agents hold, and keep information reasonably secure.

What does the CCPA require, in plain words?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights over their personal information and puts duties on the businesses that handle it. In substance:

• give notice at or before collection of what is collected and why;
• collect, use and keep personal information only as reasonably necessary and proportionate to the disclosed purposes;
• let consumers know, access, delete and correct their information;
• let them opt out of its sale or sharing for cross-context behavioural advertising;
• let them limit the use of sensitive personal information, such as financial account details, precise location and health data;
• not discriminate against consumers who exercise their rights;
• use contracts with service providers and contractors that restrict what they do with the data;
• maintain reasonable security.

The law defines personal information broadly, including inferences drawn to create a profile. Specific rules on automated decision-making are covered in CCPA and AI agents that make decisions about consumers.

Who does it apply to?

For-profit businesses doing business in California that meet the law's thresholds, and the service providers and contractors that process data for them. The protected people include customers, employees and job applicants resident in California.

Information covered by GLBA, HIPAA and federal credit reporting law is largely carved out, so a bank or a health provider will find much of its agents' data handled under those laws instead. The rest, such as marketing data, website interactions and employee data, usually remains in scope. The short answer on scope is in does the CCPA cover AI agents.

What changes when the processing is done by an agent?

Agents widen the gap between what a business says it does with data and what actually happens. Four points need attention.

Inferences are personal information. An agent that concludes a shopper is likely pregnant, or a caller is under financial strain, has created personal information, potentially sensitive. It must be disclosed in notices and included in access requests.

Proportionality has to hold at tool level. A returns agent with access to full purchase history, browsing data and payment details will use more than it needs. The law's necessity and proportionality test is met in the agent's permissions, not in the privacy policy.

Vendor status depends on the contract and the conduct. An agent platform is a service provider only if the contract restricts it to your business purposes and it does not use your data for its own. If the vendor or its model provider uses your customers' data to improve models for other clients, that can break service provider status and turn the transfer into a sale or sharing. The parallel EU analysis is in GDPR processors and controllers when you use an agent platform.

Deletion has to reach agent memory. If agents keep conversation histories, summaries or retrieval indexes, a deletion request must reach those too.

How do you meet the CCPA when agents process personal information?

What will a regulator or auditor ask?

• What personal information do your agents collect or infer, and is it in your notice?
• Does any agent infer sensitive personal information?
• Does your agent vendor or its model provider use your customers' data for anything other than serving you?
• When a consumer asks for deletion, which agent stores do you clear?
• Do any agents send data to advertising partners, and how is opt-out status checked?
• How do you verify identity when an agent handles a consumer rights request?

What does the CCPA not cover?

It does not cover most data regulated by GLBA, HIPAA or federal credit reporting law. It does not regulate AI systems as such or classify them by risk. It does not apply to businesses below its thresholds. And it is a state law: other states have their own privacy statutes, and Colorado has passed an AI act aimed at high-risk systems that make consequential decisions. For the wider map, see AI agent regulation mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

Where Pryme fits

Pryme gives each agent capability its own sources, so a returns agent reads order data without seeing payment history it was not granted. Pryme does not update model weights for a customer, which keeps customer data out of model training, and every action is filed so you can show what data an agent used for a given consumer.