Public comments split over CPPA automated decision-making rules, opt-outs and training-data limits

SACRAMENTO, Feb. 19, 2025 — Public commenters at a California Privacy Protection Agency (CPPA) hearing on Feb. 19 pressed sharply divergent views on proposed rules for automated decision‑making technology, with industry groups warning of large economic and compliance costs and privacy and labor advocates urging stricter opt‑out, transparency and training‑data limits.

The proposed regulations would create new requirements for businesses that use automated decision‑making technology (ADMT), including disclosures, risk assessments and consumer opt‑out rights. The CPPA held the hearing as the final day for oral public comments on a rulemaking package that also addresses cybersecurity audits, risk assessments and insurance‑sector regulations.

Why it matters: ADMT rules could affect advertising, website design and model training practices used across sectors from retail and life sciences to healthcare and the arts. Industry witnesses told the agency the proposals risk significant costs and lost customers; privacy groups and worker representatives called for stronger safeguards and said current commercial uses of ADMT can cause real harms to consumers and workers.

Industry concerns

Small business owners said the ADMT notice and opt‑out mechanisms, plus pop‑up screens, would reduce web traffic and harm revenue. Jeff Bond, who identified himself as founder of Inspect.net, said his inspection business relies on targeted digital ads and that "If people don't visit my website, I'll go out of business." Jerrick Sobey, co‑owner of Lucky Feet Shoes, said his 13‑store retail business "gets over a hundred thousand website hits annually" and that mandatory pop‑ups would substantially reduce visitors and sales.

Trade groups and business coalitions pressed broader economic arguments. Travis Frazier of the Association of National Advertisers warned the rules would "create extraordinarily broad foundational definitions" and could threaten commercial speech. Rob Retzlaff of the Connected Commerce Council (3C) said the provisions would "likely hurt California small businesses" by making first‑party advertising harder to use. Multiple groups cited the CPPA's standardized regulatory impact assessment figures — including a frequently cited estimate of roughly $3.5 billion in first‑year costs and recurring compliance expenses — and warned of potential job and competitiveness impacts.

Calls for clarity, exceptions and narrower scope

Some commenters urged the CPPA to narrow definitions and create exceptions for low‑risk uses. Veil Lamont of the Future of Privacy Forum said the agency's narrowing of the ADMT scope to systems that "substantially facilitate a decision" was a useful direction but called for clearer definitions of terms such as "key factor" and "primary factor." Lamont recommended categorical exceptions for low‑risk, narrow procedural systems and urged inclusion of cybersecurity uses as presumptively excepted.

Privacy, worker and artist perspectives

Privacy and civil‑society groups argued the agency has clear authority under the California Consumer Privacy Act to regulate ADMT and pressed for stronger consumer rights. Sarah Gagan, senior counsel at the Electronic Privacy Information Center (EPIC), said the ADMT rules should retain behavioral‑advertising opt‑outs and extend opt‑out rights to use of personal data for training generative AI, adding that "risk assessments are crucial" and should include public access and plain‑language explanations.

Labor and healthcare advocates urged protections for workers and patients. Carmen Comstee of the California Nurses Association said ADMTs are being used in clinical settings and "life and death decisions relating to patient treatments" may rely on opaque systems; she urged agency review mechanisms for company risk assessments.

Artists, creatives and voice actors urged pre‑use controls on training data. Diana Eigelsrud of the Concept Art Association and multiple speakers representing voice actors said dataset ingestion can be irreversible and harms creators' livelihoods. Tim Friedlander, president of the National Association of Voice Actors, called for consent and a pre‑use opt‑out, saying synthetic voice creation can enable fraud and erode professionals' work. Another speaker summarized artists' demands: "The only option here is to immediately enact a pre use opt out." Karen Guilfry, vice president of the National Association of Voice Actors, said, "My voice, my choice."

Points of legal authority and process

Several business commenters argued the rules exceed the CPPA's authority under Proposition 24 and called for legislative review. Commenters cited Proposition 24's regulatory‑balance language and referenced Government Code provisions discussed in their written comments. Others urged the agency to coordinate with the legislature and with national bodies when drafting industry‑specific rules.

What the CPPA said about the process

Agency staff and counsel opened the hearing and reminded attendees that the comment period closed Feb. 19, that oral and written comments "are treated equally," and that the agency would respond to comments in a final statement of reasons pursuant to the Administrative Procedures Act.

Where this goes next

The agency will review written and oral comments as part of the rulemaking record and may propose amendments to the draft regulations; commenters who provided contact information will receive notice of any proposed changes. The CPPA did not take any formal votes at the hearing.

Ending: Stakeholders who spoke said they had also submitted written comments and redlines; several asked the CPPA either to narrow scope, clarify definitions for businesses, or strengthen consumer and worker protections before finalizing rules.