Highlights
|
Impacted employers: The California Privacy Protection Agency (CPPA) rules apply to businesses operating in California that have annual gross revenue over $25 million or process data on more than 100,000 individuals (not just in the employment context).
The California Civil Rights Council (CCRC) provisions apply to any employer with five or more employees.
Effective dates: Businesses operating in California must comply with the new requirements from the CPPA effective Jan. 1, 2026 and from the CCRC effective Oct. 1, 2025.
Summary: California has enacted two sets of new regulations that directly impact how employers use automated decision systems (ADSs) in hiring, promotion, compensation, and other significant employment decisions.
Next steps:
- Collaborate across HR, legal, and IT teams to ensure all ADS are identified and assessed.
- Train staff on new compliance obligations and individual rights under California law.
- Monitor regulatory updates from the CPPA and CCRC for further guidance or clarifications.
- Review key steps for employers below for more specifc recommendations.
|
Key steps for employers
1. Assess and document your use of automated systems
Employers should identify all ADSs used in employment decisions, including recruitment, screening, hiring, promotion, compensation, and termination. The CCPA regulations apply only to ADSs that substantially replace human decision-making, while the CCRC regulations apply to those that facilitate human decision-making.
- Action step: Conduct a thorough inventory of all ADS in use and document their functions and decision points.
2. Conduct risk assessments and anti-bias testing
Before deploying or updating any ADS, businesses subject to the CPPA rules are required to evaluate the risks associated with their use. This includes assessing potential discriminatory impacts on protected groups and the privacy risks related to personal data processing. And the CCRC rules allow anti-bias testing as a liability defense.
- Action step: Implement formal risk assessments for each ADS, focusing on impacts to protected characteristics (such as age, sex, disability, religion, and national origin). Where appropriate, incorporate anti-bias testing and document the results as part of your compliance record.
3. Provide transparency and notice to applicants and employees
The CCPA regulations require employers to inform individuals when ADSs are used to make significant employment decisions. Notices should explain what personal information is processed, how the system works, and how outputs influence employment outcomes. The CPPA regulations also provide explicit rights related to ADS use, including the rights to access, delete, correct, appeal, and opt out (although the opt-out right does not apply in the employment context).
- Action step: Develop clear, accessible notices for applicants and employees, describing the use of ADSs and their rights under California law.
4. Respect consumer rights and accommodations
California law grants individuals rights to access, correct, delete, and opt out of ADS-driven decisions involving their personal data. Employers must establish processes to respond to these requests in a prompt manner.
- Action step: Set up procedures for handling requests related to an ADS.
5. Retain records and prepare for audits
Under the CCRC rules, employers are required to retain all records related to significant employment decisions made or influenced by an ADS—including data, assessments, and testing results—for at least four years. This obligation extends to any proceedings or investigations related to employment practices.
- Action step: Update your record retention policies to ensure compliance with the four-year requirement and organize documentation for potential audits or legal inquiries.
6. Review advertising and recruitment practices
The CCRC regulations explicitly cover recruitment and advertising methods that use ADS. Employers must ensure these practices do not result in discriminatory targeting or exclusion.
- Action step: Audit recruitment and advertising channels for compliance and adjust targeting criteria to avoid discriminatory outcomes.
Looking ahead
California’s new rules reflect a growing national focus on responsible AI and automation in the workplace. By taking proactive steps now, employers can not only avoid costly penalties but also build trust with applicants and employees.
For more information, visit the official CPPA and CCRC websites or consult with a qualified compliance professional.