CCPA + AI

The California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to AI systems that process personal information of California residents and grants rights including access, deletion, and opt-out of automated decision-making.

What is CCPA + AI?

The CCPA gives California residents rights similar in spirit to GDPR, with notable differences in scope (commercial activity threshold, sale and sharing definitions). The CPPA's 2024 automated decision-making rules add specific obligations for systems making 'significant decisions' about consumers, including pre-use risk assessments, transparency notices, and access and opt-out rights.

How does CCPA + AI apply to enterprise AI?

US enterprises with California customers and AI-driven decisions must publish ADM disclosures, support opt-out and access requests, and document risk assessments. Many vendors design once for GDPR and reuse the controls for CCPA with minor adaptations.