CPPA narrows draft ADMT rules, removes behavioral-advertising trigger and asks staff for targeted redrafts

California Privacy Protection Agency board members spent the bulk of their April 4 meeting debating proposed regulations on automated decision‑making technology, risk assessments and cybersecurity audits and directed staff to narrow several definitions and remove a high‑profile behavioral‑advertising trigger from the draft.

The board’s meeting followed a 45‑day public comment period. Philip Laird, the agency’s general counsel, told the board staff had identified six “high priority” issues and presented alternatives for each. "Staff are prepared to walk the Board and the public through six high priority issues," Laird said as the discussion opened. Board members then debated definitions, thresholds and enforcement mechanics for more than four hours.

The board’s direction and why it matters

Board members and staff agreed on several policy moves that narrow the draft regulations’ reach rather than expand it. Major board directions from the meeting, summarized by staff and confirmed by multiple board members, were: - Remove the draft’s profiling‑for‑behavioral‑advertising threshold from both the risk‑assessment and ADMT (pre‑use notice/opt‑out) sections. Staff said that deletion would leave the underlying sale/share opt‑out framework in statute but would remove a separate ADMT/assessment trigger for behavioral‑targeting profiling. Several industry commenters had argued the draft would otherwise limit first‑party advertising and small‑business marketing; consumer‑advocacy groups had urged keeping the threshold. The board chose removal as the near‑term course. - Narrow the ADMT definition toward a human‑involvement standard (staff’s “Alternative 2”) rather than the broader formulation that would capture systems that merely assist human decision‑making. Under the narrower approach, meaningful human involvement would take regulated systems out of the ADMT bucket; by contrast, systems that operate without such involvement would remain in scope. Board members said they prefer a narrower, APA‑clarified test drawn from concepts in GDPR and Colorado law but rewritten to meet California administrative‑rule clarity requirements. - Remove explicit…