California: notice, opt-out, access, and a date to watch

California takes a different route to a similar destination, and it is worth knowing because it reaches organisations that have no European presence and assumed none of this applied to them.

What the regulations do

The California Privacy Protection Agency's regulations on automated decision-making technology were approved on 23 September 2025 and took effect on 1 January 2026. The ADMT duties themselves apply from 1 January 2027. That gap is deliberate and it is the most commonly misread part: the regulations are in effect, the specific obligations arrive later, and treating the later date as the start of the whole regime is a mistake.

Three duties attach where ADMT is used for a significant decision.

Pre-use notice. The person is told before the technology is used on them, not afterwards.

The right to opt out. A right the EU and Swiss models do not frame this way. Under Article 21 revFADP and GDPR Article 22 the person can contest and seek human review after the fact. Here the person can decline the automated processing itself.

The right to access. Information about the use of the technology in relation to that person.

What counts as a significant decision

The definition is enumerated rather than left to judgement, which makes it unusually easy to apply. It covers decisions concerning financial or lending services, housing, education, employment or independent contracting, and healthcare.

Advertising is excluded. That exclusion is doing a lot of work, and it explains why the regime lands squarely on the functions in scope and leaves marketing alone.

Read that list against a typical financial services organisation. Lending decisions, insurance underwriting where it touches financial services, recruitment, and anything health-related are all in. This is not a peripheral regime for such a firm.

Three systems, one comparison

The three regimes agree on the general shape and differ in the mechanism, and the differences are the part you need.

What triggers them. Switzerland and the EU both use a threshold of a solely or exclusively automated decision with legal or significant effect. California uses an enumerated list of decision types. The list is easier to apply and harder to argue with. The threshold is broader but invites the argument about whether a human was really deciding.

What the person gets. Switzerland: information, the chance to state a position, and human review, plus information on the logic under Article 25(2). The EU: the Article 22 protections, plus the Article 26(11) duty on deployers of Annex III systems to inform people subject to them. California: notice before use, opt-out, and access.

When it bites. Switzerland and the EU now. California's ADMT duties from 1 January 2027.

Other American instruments, and what they do not do

Colorado is the cautionary example. SB 24-205 was repealed and replaced by SB 26-189, signed 14 May 2026 and effective 1 January 2027. The impact assessment duty and the rebuttable presumption tied to the NIST AI Risk Management Framework were removed. What survives is developer-to-deployer documentation, pre-use consumer notice, disclosure after an adverse decision within 30 days, and three-year record retention. Anyone still planning against an impact assessment duty in Colorado is planning against a repealed law.

Illinois HB 3773, effective 1 January 2026, amends the Human Rights Act to prohibit AI with a discriminatory effect in employment decisions, prohibits zip code as a proxy, and requires notice of AI use. Texas TRAIGA, HB 149, also effective 1 January 2026, takes an intent-based rather than effect-based approach, is enforced exclusively by the Attorney General with a 60-day cure period, and nullifies local AI ordinances.

The pattern across these is that duties to notify and to document survive drafting cycles, while duties to assess are the ones that get removed. That is a useful thing to know when deciding where to invest first.

As of 24 September 2026.