California Privacy Protection Agency (CPPA) is taking a significant step in regulating Artificial Intelligence (AI)
California Privacy Protection Agency (CPPA) by introducing draft regulations that focus on automated decision-making technology (ADMT). The CPPA plays a crucial role in shaping digital rules, especially for tech giants operating in the state.
According to Ashkan Soltani, the CPPA’s Executive Director, these draft regulations are the most comprehensive in the AI space, drawing inspiration from the European Union’s General Data Protection Regulation (GDPR). The CPPA aims to enhance GDPR provisions with more specific rules, making it challenging for tech giants, particularly those in adtech, to sidestep regulations.
Key elements of the proposed regime include opt-out rights, pre-use notice requirements, and access rights for California residents to understand how their data is utilized in automation and AI technologies.
One notable aspect is the potential inclusion of AI-based profiling, which could impact major adtech companies like Meta. The proposed law may require these companies to allow California residents to opt-out of commercial surveillance, with limited exemptions for behavioral advertising use-cases.
The CPPA’s approach aligns with a risk-based model, similar to the EU’s draft AI Act, emphasizing the responsible use of AI technologies. With the EU facing challenges in finalizing its AI Act, California might emerge as a global leader in AI regulations.
While California’s impact may primarily be local, the CPPA’s push for comprehensive rules began with the introduction of the California Consumer Privacy Act (CCPA) in 2019. The proposed AI regulations build on this foundation, aiming to give consumers control over their data in the realm of automation and AI.
The planned regulations focus on access and opt-out rights related to ADMT. Businesses intending to use ADMT would need to provide residents with the ability to opt-out, with specific exemptions for security, fraud prevention, safety, and requested goods or services.
The goal is to impose a compliance cost on businesses attempting to deny consumers the right to opt-out of AI-driven data processing. To ensure transparency, businesses must provide pre-use notices to consumers affected by ADMT, allowing them to make informed decisions about their data.
Additionally, the proposed framework includes GDPR-like access rights, enabling residents to request details about ADMT usage, technology output, decision-making processes, logic, and more.
The CCPA’s draft regulations set thresholds for decisions with significant effects on consumers, profiling employees, and profiling consumers in publicly accessible places. The upcoming consultation will further explore whether the rules should extend to behavioral advertising, profiling children, and processing personal information for training ADMT.
The CPPA’s rulemaking process has just begun, with a consultation process expected to kick off soon. While the timeline for finalizing regulations is unclear, there is potential for California to establish a robust AI regulatory framework by the second half of next year.
