California Draft Rules for AI Decisions Let Consumers Opt Out

California’s privacy board released draft rules for automated decision-making technologies that could impose first-in-the-nation guardrails on how AI-driven technologies are used on consumers.

The draft released Monday by the California Privacy Protection Agency would require businesses that use personal information to allow consumers to opt out of having their data processed using the technology. It would require businesses to provide consumers with information about how they use automated technologies in their decision-making and ways to opt-out. Information to be provided by businesses would include the intended output of the technology, how businesses plan to use it, and whether the technology has been assessed for reliability and fairness.

The rules would apply to systems, software, and processes that use consumers’ personal information to make or facilitate a decision, including those using machine-learning or artificial intelligence. Covered technologies would include those that use automated decision-making to evaluate resumes and worker-monitoring software such as keystroke loggers.

The CPPA’s governing board is scheduled to discuss the draft regulations at its Dec. 8 meeting.

Gov. Gavin Newsom in September signed an executive order directing agencies to study the security and privacy risks of the state government’s use of AI. The first set of recommendations on the use of generative AI stemming from the executive order—including a call to have humans review any AI outputs—were released last week.

California would be the first state to roll out major guardrails on automated decision-making. Earlier this year the New York City Department of Consumer and Worker Protection adopted rules regulating the use of automated hiring tools.