CCPA ADMT pre-use notice and opt-out: what must your firm provide?

If your firm uses software that screens résumés, ranks applicants, assigns work or sets pay for California staff with little human review, that software likely needs an ADMT pre-use notice and a working opt-out or appeal route by January 1, 2027. Missing it is a California Privacy Protection Agency enforcement issue and a hard conversation with the people you hire. This checklist covers what the notice must say, where it goes, how the opt-out must work and which deadlines your team will need to track.

When do the CCPA ADMT requirements apply?

The CCPA requirements for automated decisionmaking technology (ADMT) apply from January 1, 2027, for any business already using ADMT to make a significant decision about a consumer. Under the regulations California approved in September 2025, a business that starts using ADMT for a significant decision after that date must comply from the moment it starts (Cal. Code Regs., tit. 11, § 7200). The wider set of regulations took effect January 1, 2026.

A significant decision is one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (§ 7001). For most professional firms, the live exposure is employment: tools that screen résumés, rank applicants, allocate work or set pay. A financial firm's client data handled under the Gramm-Leach-Bliley Act is largely outside the CCPA under Civil Code section 1798.145(e), but employee and applicant data generally is not, as our article on the CCPA GLBA exemption explains. Whether a given tool counts as ADMT at all depends on how much a human actually reviews its output, which our guide to the CCPA automated decision making rules covers. This article covers what you put in front of the person.

Where and when must an ADMT pre-use notice appear?

An ADMT pre-use notice must appear at or before the point the business collects the personal information it will use with ADMT. If the information was collected for another purpose, the notice must come before the ADMT processing starts. It has to be presented prominently and conspicuously, through the channel the business mainly uses to interact with that consumer (§ 7220). For job applicants that usually means the application page or portal; for employees, the HR system or onboarding packet.

Unless an exception applies, the pre-use notice must also include a link the consumer can use to opt out of the business's use of ADMT (§ 7010(d)).

What must an ADMT pre-use notice say?

An ADMT pre-use notice must cover five things, in plain language (§ 7220):

• The specific purpose for using ADMT, described in non-generic terms. A phrase such as "to improve our hiring process" is too vague; "to rank applicants for paralegal roles based on their answers to screening questions" is the level of detail the rule points toward.
• The right to opt out and how to submit an opt-out request. A business relying on the human appeal exception explains how to appeal instead, and a business relying on another exception has to identify which one.
• The right to access information about the business's use of ADMT, and how to make that request.
• A statement that the business will not retaliate against a consumer for exercising CCPA rights.
• Additional information about how the ADMT works, which may sit behind a simple link: the categories of personal information that affect the output, the type of output and how the business uses it, whether it is the sole factor and what role any human plays, and the alternative process for consumers who opt out.

A business does not have to disclose trade secrets, or information that would compromise security, fraud prevention or physical safety. One notice can cover several ADMT tools or several purposes, as long as it includes everything required for each.

How must the ADMT opt-out work?

An ADMT opt-out must offer at least two methods, be easy to use and take effect within a fixed deadline (§ 7221):

• At least two methods, at least one of which reflects how the business primarily interacts with consumers. A business that interacts online must offer an interactive form reachable from the pre-use notice. Toll-free numbers, email addresses and mail-in or in-person forms are other options. A cookie banner does not qualify.
• No account and no verifiable consumer request. The process should take minimal steps and ask only for information needed to carry out the request.
• If the opt-out arrives before processing begins, the business may not start. If it arrives after, the business must stop as soon as feasibly possible and no later than 15 business days after receipt, and must tell the service providers and others it shared the information with to comply in the same timeframe.
• The business must confirm that the request was processed, and must wait at least 12 months before asking a consumer who opted out to consent to ADMT again.

When does a business not have to offer an opt-out?

A business does not have to offer an ADMT opt-out when one of three exceptions in § 7221(b) applies. The most widely useful is the human appeal exception. The business lets the consumer appeal the decision to a human reviewer who knows how to interpret the ADMT's output, considers it alongside other relevant information, and has the authority to overturn the decision. The appeal process has to be described in the pre-use notice and be easy to use.

The two narrower exceptions cover ADMT used solely for admission, acceptance or hiring decisions, and ADMT used solely to allocate work or set compensation. Each applies only where the tool works for its stated purpose and does not unlawfully discriminate. The human appeal route depends on a reviewer who actually has the authority to change outcomes, so staff it with someone who has time to do the review. Which route fits your firm is a decision to make with counsel.

How fast must a business answer an ADMT access request?

A business must answer an ADMT access request within 45 calendar days. It must confirm receipt within 10 business days, and the 45-day deadline can be extended to a maximum total of 90 calendar days with notice to the consumer (§ 7021). The response explains, in plain language, the specific purpose, the logic of the ADMT, and the outcome for that consumer, including how the output was used and whether it was the sole factor in the decision (§ 7222). The privacy policy must describe both the opt-out and access rights (§ 7011).

Using ADMT for a significant decision also brings in the separate risk assessment requirements in the same regulations, which the CPPA summarizes in its guide to the 2026 updates.

What should a firm do this quarter?

Start with the inventory, because every later step depends on knowing which tools are ADMT used for a significant decision.

1. List every tool that scores, ranks or screens applicants, employees, contractors or clients, and note whether a person with real authority reviews each result.
2. For each tool that is ADMT used for a significant decision, decide whether to offer an opt-out or rely on an exception, and document why.
3. Draft the pre-use notice with a specific purpose statement and the other required elements, and place it at the point of collection.
4. Set up two opt-out methods and a stop process that reaches your vendors within 15 business days.
5. Update the privacy policy to describe the ADMT opt-out and access rights, review it alongside your employee privacy notice, and set up tracking for 10-business-day confirmations and 45-day access responses.
6. Have counsel review the notice language and your exception choices before January 1, 2027.

How can s90 help your firm prepare?

s90 helps California firms find the AI and automated tools already in use, map which ones touch hiring, pay and client decisions, and set up the forms, routing and logs that show requests were handled on time. Your counsel owns the legal judgment on notices and exceptions, and we build the systems that carry them out. If you want help getting ready before January 1, 2027, we are happy to talk.