NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

DRAFT
AUTOMATED DECISIONMAKINGTECHNOLOGY REGULATIONSDECEMBER 2023

Page 1 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

Statutory Provisions for Reference:
Delegation of rulemaking authority to the California Privacy Protection Agency as set forthin Civil Code section 1798.185, subdivision (a)(16):Issuing regulations governing access and opt-out rights with respect to businesses’ useof automated decisionmaking technology, including profiling and requiring businesses’
response to access requests to include meaningful information about the logic involvedin those decisionmaking processes, as well as a description of the likely outcome of theprocess with respect to the consumer.

Page 2 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

[ADDITIONS TO] § 7001. Definitions.
“Automated decisionmaking technology” means any system, software, or process—including
one derived from machine-learning, statistics, or other data-processing or artificial
intelligence—that processes personal information and uses computation as whole or part of asystem to make or execute a decision or facilitate human decisionmaking. Automateddecisionmaking technology includes profiling.
“Decision that produces legal or similarly significant effects concerning a consumer” means adecision that results in access to, or the provision or denial of, financial or lending services,
housing, insurance, education enrollment or opportunity, criminal justice, employment or
independent contracting opportunities or compensation, healthcare services, or essential
goods or services.
“Profiling” means any form of automated processing of personal information to evaluate
certain personal aspects relating to a natural person and in particular to analyze or predict
aspects concerning that natural person’s performance at work, economic situation, health,personal preferences, interests, reliability, behavior, location, or movements.
“Publicly accessible place” means a place that is open to or serves the public. Examples ofpublicly accessible places include shopping malls, stores, restaurants, cafes, movie theaters,amusement parks, convention centers, stadiums, gymnasiums, hospitals, medical clinics oroffices, transportation depots, transit, streets, or parks.
[ADDITION] § 7017. Notice of Rights to Opt-Out of, and Access Information About, theBusiness’s Use of Automated Decisionmaking Technology.
(a)A business that uses automated decisionmaking technology as set forth insections 7030, subsection (b), and 7031, subsection (b), shall provide consumers
with the Notice of Rights to Opt-Out of, and Access Information About, theBusiness’s Use of Automated Decisionmaking Technology (“Pre-use Notice”). The
Pre-use Notice shall inform consumers about the business’s use of automateddecisionmaking technology and consumers’ rights to opt-out of, and to accessinformation about, the business’s use of automated decisionmaking technology.

(b)

The Pre-use Notice shall:(1) Comply with section 7003;(2) Be made readily available where consumers will encounter it;
Page 3 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(3) Be provided in the manner in which the business primarily interacts with theconsumer, before the business processes the consumer’s personal
information using the automated decisionmaking technology; and(4) Include the following:(A) A plain language explanation of the purpose for which the businessproposes to use the automated decisionmaking technology. The
purpose shall not be described in generic terms, such as “toimprove our services,” because generic terms are insufficient forthe consumer to understand the business’s proposed purpose forusing the automated decisionmaking technology.
(B) A description of the consumer’s right to opt-out of the business’s
use of the automated decisionmaking technology for the processing
activities set forth in section 7030, subsection (b), and how theconsumer can submit a request to opt-out of the business’s use of
the automated decisionmaking technology. This description of theconsumer’s right to opt-out shall clearly state the scope of their
opt-out right.
(i) If the business is not required to provide a right to opt-out
because it is relying upon an exception in section 7030,
subsection (m), it shall inform the consumer of that fact andidentify the specific exception it is relying upon.
(C) A description of the consumer’s right to access information about
the business’s use of the automated decisionmaking technology
with respect to the consumer for the processing activities set forthin section 7031, subsection (b), and how the consumer can submit
their access request.
(D) A simple and easy-to-use method (e.g., a layered notice or
hyperlink) by which the consumer can obtain additional information
about the business’s use of the automated decisionmaking
technology.
(i) This additional information shall include a plain language
explanation of the following:
Page 4 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

1. The logic used in the automated decisionmaking
technology, including the key parameters that affectthe output of the automated decisionmaking
technology. The business shall explain why theseparameters are key;
2. The intended output of the automated decisionmaking
technology (e.g., a numerical score of compatibility);
3. How the business plans to use the output to make adecision, including the role of any human involvement;
and
4. Whether the business’s use of the automateddecisionmaking technology has been evaluated forvalidity, reliability, and fairness, and the outcome ofany such evaluation.
(ii) The business also may include in the Pre-use Notice a
hyperlink that directs the consumer to its unabridged risk
assessment for the business’s use of the automateddecisionmaking technology.
(c)

If a business is using automated decisionmaking technology as set forth insection 7030, subsection (m), the business shall not be required to notify
consumers about the right to opt-out of the processing in a Pre-use Notice forthat use.

(d)

If a business is using automated decisionmaking technology as set forth insection 7030, subsections (m)(1)–(3), the business shall not be required todisclose information in a Pre-use Notice that would compromise its processing of
personal information for those purposes.

[ADDITION] § 7030. Requests to Opt-Out of the Business’s Use of Automated Decisionmaking
Technology.
(a)Consumers have a right to opt-out of businesses’ use of automateddecisionmaking technology as set forth in this section.

Page 5 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(b)

A business shall provide consumers with the ability to opt-out of the following
uses of automated decisionmaking technology:(1) For a decision that produces legal or similarly significant effects concerning a
consumer;(2) Profiling a consumer who is acting in their capacity as an employee,
independent contractor, job applicant, or student. For example, this includes
profiling an employee using keystroke loggers, productivity or attention
monitors, video or audio recording or live-streaming, facial- or speechrecognition or -detection, automated emotion assessment, location trackers,
speed trackers, and web-browsing, mobile-application, or social-media
monitoring tools;(3) Profiling a consumer while they are in a publicly accessible place. For
example, this includes profiling a consumer while they are in a publicly
accessible place using wi-fi or Bluetooth tracking, radio frequency
identification, drones, video or audio recording or live-streaming, facial- or
speech- recognition or -detection, automated emotion assessment,
geofencing, location trackers, or license-plate recognition;(4) SUBCOMMITTEE OPTION FOR BOARD DISCUSSION: Profiling a consumer for
behavioral advertising;(A) A business that profiles a consumer that the business has actual
knowledge is under the age of 16 for behavioral advertising shallcomply with the requirements set forth in sections 7070 and 7071;
ADDITIONAL OPTIONS FOR BOARD DISCUSSION(5) Profiling a consumer that the business has actual knowledge is under the ageof 16; or(6) Processing the personal information of consumers to train automateddecisionmaking technology.

(c)

A business that uses automated decisionmaking technology as set forth insubsection (b) shall provide two or more designated methods for submitting
requests to opt-out of the business’s use of the automated decisionmaking
Page 6 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

technology. A business shall consider the methods by which it interacts with
consumers, the manner in which the business uses the automateddecisionmaking technology, and the ease of use by the consumer when
determining which methods consumers may use to submit requests to opt-outof the business’s use of the automated decisionmaking technology. At least one
method offered shall reflect the manner in which the business primarily interacts
with the consumer. Illustrative examples and requirements follow.
(1) A business that interacts with consumers online shall, at a minimum, allow
consumers to submit requests to opt-out through an interactive form
accessible via an opt-out link that is provided in the Pre-use Notice. The link
shall be titled [Note: Agency staff recommends receiving public comment on
what the link(s) should be titled for consumers to understand the scope of the
opt-out right].
(2) A business that interacts with consumers in person and online may provide
an in-person method for submitting requests to opt-out in addition to theonline form.
(3) Other methods for submitting requests to opt-out include, but are notlimited to, a toll-free phone number, a designated email address, a form
submitted in person, and a form submitted through the mail.
(4) A notification or tool regarding cookies, such as a cookie banner or cookie
controls, is not by itself an acceptable method for submitting requests to optout of the business’s use of automated decisionmaking technology because
cookies concern the collection of personal information and not necessarily
the use of automated decisionmaking technology. An acceptable method forsubmitting requests to opt-out must be specific to the right to opt-out of thebusiness’s use of the automated decisionmaking technology.
(d)A business’s methods for submitting requests to opt-out of the business’s use of
the automated decisionmaking technology shall be easy for consumers to
execute, shall require minimal steps, and shall comply with section 7004.

(e)

A business shall not require a consumer submitting a request to opt-out of thebusiness’s use of the automated decisionmaking technology to create an accountor provide additional information beyond what is necessary to direct thebusiness to opt-out the consumer.
Page 7 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(f)

Except as set forth in subsection (f)(1), a business may require a verified
consumer request if it has determined and documented that consumers are
more likely than not to be negatively impacted if the business were to honor a
fraudulent request to opt-out consumers of the business’s use of the automateddecisionmaking technology. Negative impacts are those set forth in section 7152,
subsection (a)(8). If a business determines that verification is necessary, it shallcomply with the requirements for verification in Article 5.
(1) A business shall not require a verifiable consumer request for a request to
opt-out of profiling for behavioral advertising. A business may ask theconsumer for information necessary to complete the request, such as
information necessary to identify the consumer whose information is subject
to the business’s profiling for behavioral advertising. However, to the extent
that the business can comply with a request to opt-out without additional
information, it shall do so.

(g)

If a business has a good-faith, reasonable, and documented belief that a request
to opt-out of the business’s use of automated decisionmaking technology is
fraudulent, the business may deny the request. The business shall inform therequestor that it will not comply with the request and shall provide to therequestor an explanation why it believes the request is fraudulent.

(h)

If the consumer submits a request to opt-out of the business’s use of automateddecisionmaking technology as set forth in subsection (b), before the business has
initiated that processing, the business shall not initiate processing of theconsumer’s personal information using that automated decisionmaking
technology. If the consumer did not opt-out in response to the Pre-use Notice,and submitted a request to opt-out after the business initiated the processing,
the business shall comply with the consumer’s opt-out request by:(A) Ceasing to process the consumer’s personal information using that
automated decisionmaking technology as soon as feasibly possible, but
no later than 15 business days from the date the business receives therequest. For personal information previously processed by that
automated decisionmaking technology, the business shall neither use nor
retain that information; and(B) Notifying all the business’s service providers, contractors, or otherpersons to whom the business has disclosed or made personal
Page 8 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

information available to process the consumer’s personal information
using that automated decisionmaking technology, that the consumer has
made a request to opt-out, and instructing them to comply with theconsumer’s request to opt-out of the business’s use of that automateddecisionmaking technology within the same time frame.
(i)A business shall provide a means by which the consumer can confirm that thebusiness has processed their request to opt-out of the business’s use of theautomated decisionmaking technology.

(j)

In responding to a request to opt-out of the business’s use of automateddecisionmaking technology, a business may present the consumer with the
choice to allow specific uses of automated decisionmaking technology as long asa single option to opt-out of all of the business’s uses of automateddecisionmaking technology set forth in subsection (b) is also offered.

(k)

A consumer may use an authorized agent to submit a request to opt-out of thebusiness’s use of the automated decisionmaking technology on the consumer’sbehalf if the consumer provides the authorized agent written permission signedby the consumer. A business may deny a request from an authorized agent if theagent does not provide to the business the consumer’s signed permission
demonstrating that they have been authorized by the consumer to act on the
consumer’s behalf.

(l)Except as allowed by these regulations, a business shall wait at least 12 months
from the date the business receives the consumer’s request to opt-out of thebusiness’s use of the automated decisionmaking technology before asking a
consumer who has exercised their right to opt-out, to consent to the business’s
use of the automated decisionmaking technology for which the consumer
previously opted out.

(m)

A business is not required to provide consumers with the ability to opt-out of theuse of automated decisionmaking technology if the business’s use of that
automated decisionmaking technology is compliant with section 7002, and thebusiness’s use of that automated decisionmaking technology is necessary toachieve, and is used solely for, the following purposes:

Page 9 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(1) To prevent, detect, and investigate security incidents that compromise theavailability, authenticity, integrity, or confidentiality of stored or transmitted
personal information;(2) To resist malicious, deceptive, fraudulent, or illegal actions directed at thebusiness and to prosecute those responsible for those actions;(3) To protect the life and physical safety of consumers; or(4) To provide the good or perform the service specifically requested by the
consumer.
(A) If a business’s use of the automated decisionmaking technology is toprovide a good or opportunity or perform a service as set forth insubsection (m)(4), the business also must have no reasonable alternative
method of processing as set forth below.
(B) There is a rebuttable presumption that the business has a reasonable
alternative method of processing if there is an alternative method ofprocessing that is or has been used in the business’s industry or similarindustries to provide a similar good or perform a similar service.
(C) The business may rebut this presumption by demonstrating one or moreof the following factors:(i) It would be futile for the business to develop or use alternative
methods of processing. For example, if a business provides resumescreening and job-matching services and must screen thousands ofresumes to recommend job-matches for a same-day job
opportunity, the business could demonstrate the futility ofdeveloping or using a non-automated decisionmaking process
because it would be futile to use a non-automated decisionmaking
process to screen thousands of resumes within a few hours;(ii) Developing and using an alternative method of processing would
result in a good or service that is not as valid, reliable, and fair. For
example, if the business offers a resume-screening and jobmatching service, and an alternative method of processing for
identifying qualified job applicants is more likely than theautomated decisionmaking technology to have a disparate
Page 10 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

impact on protected classes, then using that alternative method ofprocessing would result in a service that is not as fair; or(iii) Developing an alternative method of processing would impose
extreme hardship upon the business, considering the business’s
overall financial resources and the nature and structure of its
operation, including the business’s technical capabilities. For
example, for a business with $25 million in annual gross revenue
and 20 employees, if the only available alternative method ofprocessing would impose a multi-million-dollar expense or require
the business to hire 50 new employees with specific technicalexpertise, the business could demonstrate that developing thisalternative method of processing would impose extreme hardshipupon the business.
(D) If there is no alternative method of processing that is or has been used in
the business’s industry or similar industries to provide a similar good or
perform a similar service, and the business can demonstrate any of thefactors set forth in subsections (C)(i)–(iii), the business has no reasonable
alternative method of processing.
(E) Any business relying on this exception to not provide a consumer withthe ability to opt-out of its use of the automated decisionmaking
technology shall document its explanation of how it meets therequirements in subsection (m)(4)(A)–(D), and shall provide such
explanation to the Agency within five (5) business days of the Agency’s
request.
(n)

If a business is profiling a consumer for behavioral advertising, the businesscannot rely on the exceptions set forth in subsection (m) and shall be required toprovide consumers with the ability to opt-out of that use of automateddecisionmaking technology.

(o)If a business is using automated decisionmaking technology as set forth insubsection (b), the business shall provide consumers with a method to submit acomplaint about the business’s use of the automated decisionmaking technology
to the business, and shall explain how consumers can submit a complaint.

Page 11 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

[ADDITION] § 7031. Requests to Access Information About the Business’s Use of AutomatedDecisionmaking Technology.
(a)Consumers have a right to access information about the business’s use of
automated decisionmaking technology as set forth in this section.

(b)

If the business uses automated decisionmaking technology for any processing set
forth in section 7030, subsection (b), then the business shall provide consumers
with access to information about the business’s use of that automateddecisionmaking technology (“right to access” or “access right”).

(c)

A business’s methods for consumers to submit requests to exercise their accessright shall comply with section 7020.

(d)

If a business has made a decision that results in the denial of goods or services as
set forth in section 7030, subsection (b)(1), with respect to the consumer (e.g.,denied the consumer an employment opportunity or lowered theircompensation), the business shall notify the consumer of the following, via themethod by which the business primarily interacts with the consumer:(1) That the business made a decision with respect to the consumer;(2) That the consumer has a right to access information about the business’s useof that automated decisionmaking technology;(3) How the consumer can exercise their access right; and(4) That the consumer can file a complaint with the Agency and the Attorney
General. The business also shall provide links to the complaint forms on theirrespective websites. For example, the business can include the following
language in its response to the consumer: “If you believe your privacy rights
have been violated, you can submit a complaint to the California Privacy
Protection Agency at [link to complaint form] or to the California Attorney
General at [link to complaint form].”(e)

For requests to exercise the right to access, if a business cannot verify theidentity of the person making the request pursuant to the regulations set forth in
Article 5, the business shall not disclose the information identified in subsections(i)(2)–(5) and shall inform the requestor that it cannot verify their identity.
Page 12 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(f)

If a business denies a consumer’s verified request to exercise their right toaccess, in whole or in part, because of a conflict with federal or state law, or an
exception to the CCPA, the business shall inform the requestor and explain thebasis for the denial, unless prohibited from doing so by law. If the request isdenied only in part, the business shall disclose the other information sought by
the consumer.

(g)

A business shall use reasonable security measures when transmitting therequested information to the consumer.

(h)

If a business maintains a password-protected account with the consumer, it may
comply with a request to exercise the right to access by using a secure selfservice portal for consumers to access, view, and receive a portable copy of theirrequested information if the portal fully discloses the requested information thatthe consumer is entitled to under the CCPA and these regulations, uses
reasonable data security controls, and complies with the verification
requirements set forth in Article 5.

(i)

In responding to a consumer’s request to exercise their access right, a businessshall provide plain language explanations of the following information to theconsumer:(1) The purpose for which the business used automated decisionmaking
technology. The purpose shall not be described in generic terms, as set forthin section 7017, subsection (b)(4)(A).
(2) The output of the automated decisionmaking technology with respect to theconsumer.
(A) If the business has multiple outputs with respect to the consumer,
the business shall provide a simple and easy-to-use method bywhich the consumer can access all of the outputs.
(3) How the business used the output to make a decision with respect to theconsumer. This explanation shall include:(A) The decision (including, for example, the placement of a consumer
into a category or segment as a result of profiling) that was made,executed, or facilitated by the business’s use of the automateddecisionmaking technology with respect to the consumer;
Page 13 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

(B) Any factors other than the output that the business used to makethe decision;(C) The role of any human involvement in the business’s use of theautomated decisionmaking technology; and(D) Whether the business’s use of the automated decisionmaking
technology has been evaluated for validity, reliability, and fairness,and the outcome of any such evaluation.
(4) If the business plans to use the output to make a decision with respect to theconsumer, the business’s explanation shall include:(A) How the business plans to use the output to make a decision withrespect to the consumer;(B) Any factors other than the output that the business plans to use to
make the decision;(C) The role of any human involvement in the business’s use of theautomated decisionmaking technology; and(D) Whether the business’s use of the automated decisionmaking
technology has been evaluated for validity, reliability, and fairness,and the outcome of any such evaluation.
(5) How the automated decisionmaking technology worked with respect to theconsumer. At a minimum, this explanation shall include:(A) How the logic, including its assumptions and limitations, wasapplied to the consumer; and(B) The key parameters that affected the output of the automateddecisionmaking technology. The business shall explain why theparameters were key, and how those parameters applied to theconsumer.
(6) A simple and easy-to-use method by which the consumer can obtain therange of possible outputs, which may include aggregate output statistics (forexample, the five most common outputs of the automated decisionmaking
technology, on average, across all consumers during the preceding
Page 14 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

calendar year, and the percentage of consumers that received each output
during the preceding calendar year).
(7) Instructions for how the consumer can exercise their other CCPA rights.
These instructions shall include any links to an online request form or portal
for making such a request, if offered by the business.
(A) The business may comply with this requirement by providing a linkthat takes the consumer directly to the specific section of thebusiness’s privacy policy that contains these instructions. Directing
the consumer to the beginning of the privacy policy, or to anothersection of the privacy policy that does not contain these
instructions, so that the consumer is required to scroll throughother information in order to find the instructions, does not satisfy
this standard.
(8) In accordance with the requirement in section 7030, subsection (o), thebusiness shall provide instructions regarding the method by which theconsumer can submit a complaint to the business about the business’s use of
the automated decisionmaking technology, including a complaint about aspecific decision and how the decision was or will be made with respect tothe consumer. The business also shall:(A) Explain that the consumer can file a complaint with the Agency andthe Attorney General and provide links to the complaint forms on
their respective websites. For example, the business can include thefollowing language in its response to the consumer: “If you believe
your privacy rights have been violated, you can submit a complaint
to the California Privacy Protection Agency at [link to complaintform] or to the California Attorney General at [link to complaintform].”(j)

If a business’s use of the automated decisionmaking technology is solely as set
forth in section 7030, subsection (m), the business shall not be required toprovide the ability to opt-out or an opt-out link or include information about thisright in its response to a request to access.

(k)

If a business’s use of the automated decisionmaking technology is solely as set
forth in section 7030, subsections (m)(1)–(3), the business shall not be required
Page 15 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

to disclose information in its response to a request to access that would
compromise its processing of personal information for those purposes.
(l)

A service provider or contractor shall provide assistance to the business in
responding to a verifiable consumer request to access, including by providing thebusiness with the consumer’s personal information it has in its possession that itcollected pursuant to their written contract with the business, or by enabling thebusiness to access that personal information.

Page 16 of 17

NOTE: The Agency has not yet started the formal rulemaking process for cybersecurity
audits, risk assessments, or automated decisionmaking technology. This draft text in thisdocument is intended to facilitate Board discussion and public participation and is subject tochange. Text preceded by “FOR BOARD DISCUSSION” presents topics for Board discussion.

For Consideration in Conjunction with Section 7030, Subsection (b)(4)(A)(“Profiling for Behavioral Advertising”)[ADDITIONS TO] ARTICLE 6. SPECIAL RULES REGARDING CONSUMERS UNDER 16 YEARS OF
AGE§ 7070. Consumers Less Than 13 Years of Age.
(c) Process for Opting-In to Profiling for Behavioral Advertising(1) A business that has actual knowledge that it profiles a consumer less than
the age of 13 for behavioral advertising shall establish, document, andcomply with a reasonable method for a parent or guardian of that child to
opt-in to the use of profiling for behavioral advertising, and for determiningthat the person consenting to the profiling is the parent or guardian of thatchild. This consent to the profiling is in addition to any verifiable parental
consent required under COPPA.
(2) Methods that are reasonably calculated to ensure that the person providing
consent is the child’s parent or guardian include those set forth in subsection(a)(2).
(d) When a business receives consent to profiling for behavioral advertising pursuant tosubsection (c), the business shall inform the parent or guardian of the right to optout of profiling for behavioral advertising and of the process for doing so on behalfof their child pursuant to section 7030.
§ 7071. Consumers at Least 13 Years of Age and Less Than 16 Years of Age.
(c) A business that has actual knowledge that it profiles a consumer at least 13 years ofage and less than 16 years of age for behavioral advertising shall establish,
document, and comply with a reasonable process for allowing such consumers to
opt-in to the use of profiling for behavioral advertising.
(d) When a business receives a request to opt-in to the profiling of a consumer at least
13 years of age and less than 16 years of age for behavioral advertising, the businessshall inform the consumer of their ongoing right to opt-out of the use of profiling for
behavioral advertising at any point in the future and of the process for doing so
pursuant to section 7030.
Page 17 of 17