California's Privacy Watchdog Eyes AI Rules with Opt-Out and Access Rights

California's Privacy Protection Agency (CPPA) is taking a significant step towards regulating Artificial Intelligence (AI) by proposing new draft rules for Automated Decisionmaking Technology (ADMT). These regulations aim to provide consumers with greater control over their data when it's used in AI systems, drawing inspiration from the European Union's General Data Protection Regulation (GDPR) but with more specific provisions.

Key Proposals from the CPPA

The core of the CPPA's proposed regime includes:

Opt-Out Rights: Consumers will have the right to opt-out of their data being processed for automated decisionmaking, including profiling for behavioral advertising.
Access Rights: Individuals can request meaningful information about how their data is used in AI, including details on the logic, parameters, and outcomes of automated decisions.
Pre-Use Notice Requirements: Businesses will need to inform consumers before using their data for ADMT, allowing them to make informed decisions about opting out or exercising their access rights.

Impact on Adtech and AI Giants

These proposed rules could have substantial implications for major tech companies, particularly those in the adtech and AI sectors, such as Meta and OpenAI. The regulations target practices like user tracking and profiling for targeted advertising, potentially requiring companies to offer California residents the ability to deny commercial surveillance.

Ashkan Soltani, the CPPA's executive director, described the draft as "by far the most comprehensive and detailed set of rules in the ‘AI space’." The approach is risk-based, similar to the EU's AI Act, aiming to ensure AI technologies are developed and used with privacy in mind.

Specific Provisions and Exemptions

The draft regulations outline specific requirements for businesses using ADMT:

Opt-Out Exemptions: While opt-out rights are central, limited exemptions are proposed for data use necessary for security, fraud prevention, or safety. However, using ADMT for a requested good or service comes with strict caveats, requiring businesses to demonstrate that no reasonable alternative processing method exists or that alternatives would be less valid, reliable, or fair, or impose extreme hardship. This aims to prevent companies from broadly claiming AI use as an excuse to deny opt-outs.
Transparency: The pre-use notices are designed to enhance transparency, mirroring GDPR's obligations. However, the CPPA's approach seeks to be more robust than GDPR's exceptions, which sometimes allowed companies to withhold information if it was deemed "unreasonably expensive" or "impossible."
Access Rights Details: The proposed framework specifies the information consumers can request, including details on ADMT use, decision logic, key parameters, range of possible outputs, and how the consumer can exercise other CCPA rights. This aims to preempt attempts by companies to evade transparency requirements.

Scope and Future Considerations

The scope of the regulations is still under discussion, with the CPPA considering whether to apply them to:

Profiling for behavioral advertising.
Profiling of children (under 16).
Processing personal information to train ADMT.

The CPPA plans to begin formal rulemaking next year after a consultation process. If finalized, these regulations could position California as a global leader in AI governance, especially in the absence of comprehensive federal privacy laws in the US. However, the direct enforcement reach of these rules is limited to California residents.

Background and Context

The CPPA's efforts build upon the California Consumer Privacy Act (CCPA), which came into effect in 2020. The proposed ADMT rules are part of an ongoing effort to strengthen consumer privacy rights in the state. The agency expects to discuss these proposed regulations at its December 8, 2023, board meeting.

The CPPA's definition of ADMT includes any system that processes personal information and uses computation to make or facilitate decisions, explicitly including profiling. This comprehensive approach aims to ensure that automated decisionmaking technologies are used responsibly and with privacy considerations embedded by design.

California's Privacy Watchdog Eyes AI Rules with Opt-Out and Access Rights

California's Privacy Watchdog Eyes AI Rules with Opt-Out and Access Rights

Key Proposals from the CPPA

Impact on Adtech and AI Giants

Specific Provisions and Exemptions

Scope and Future Considerations

Background and Context

Related Content