The California Privacy Protection Agency (CPPA) is taking steps to regulate the use of artificial intelligence (AI) by publishing draft regulations for automated decision-making technology (ADMT). The CPPA aims to establish a comprehensive set of rules inspired by the European Union’s General Data Protection Regulation (GDPR) but with more specific provisions.
Key Takeaway
The proposed regulations by the CPPA will give Californian residents opt-out and access rights for their data in automation and AI technologies. Companies may need to offer the ability to opt-out of behavioral advertising and provide transparency in how data is used. The regulations, if finalized, would apply within California and could set a precedent for AI regulation.
Opt-Out and Access Rights
The draft regulations proposed by the CPPA include opt-out rights, pre-use notice requirements, and access rights for California residents. These measures would give individuals control over how their data is used in automation and AI technology. The regulations would particularly impact companies involved in AI-based profiling and behavioral advertising.
- Opt-Out Rights: Companies would be required to offer California residents the ability to opt-out of their data being processed for behavioral advertising.
- Pre-Use Notice: Businesses using ADMT must provide pre-use notices to affected consumers, allowing them to make informed decisions about their data usage.
- Access Rights: State residents would have the right to obtain meaningful information about how their data is being used for automation and AI tech, including details about the decision-making process and any human involvement.
The CPPA’s approach to regulating ADMT is risk-based and aligns with the proposed AI Act in the European Union. However, unlike EU regulations, California’s AI rules would only apply within the state’s borders, unless companies choose to extend similar privacy protections to residents of other US states.
Regulatory Framework
The CPPA is currently in the process of finalizing the regulations after a consultation period. The proposed framework also includes draft risk assessment requirements that would work in tandem with the ADMT rules. The aim is to provide consumers with control over their personal information while ensuring that automation and AI technologies are designed with privacy in mind.
Implications for Businesses
The CPPA’s proposed regulations seek to address the responsible use of ADMT while providing guardrails for privacy. Businesses that rely on automation and AI technologies, such as adtech giants, may face compliance costs and limitations on their data processing practices. The regulation is expected to be finalized in the second half of next year, with companies given a grace period for compliance.
The CPPA’s efforts highlight California’s ongoing commitment to privacy protection and its intention to lead in regulating emerging technologies. The proposed regulations build upon the California Consumer Privacy Act (CCPA) and aim to provide additional safeguards for consumers, including employees and children, while addressing the risks associated with automation and AI.
