FEHA ADS vs CCPA ADMT
The difference, stated plainly, for anyone who has been told they are the same thing.
California
California AI hiring laws
California has two AI hiring laws, run by two different agencies, on two different clocks. The FEHA rules are already in force; the CCPA ADMT notice is due January 1, 2027. Complying with one does nothing for the other, so here is what each of them asks of you.
The two regimes, side by side
Here is what is actually different. Every cell below comes from the agency named in its column.
| FEHA automated-decision systems | CCPA automated decisionmaking technology | |
|---|---|---|
| Agency | Civil Rights Department, Civil Rights Council | California Privacy Protection Agency |
| Short name in use | ADS | ADMT |
| In force | October 1, 2025 | Regulations effective January 1, 2026 |
| Deadline still ahead | None — already in force | January 1, 2027 for pre-use notice, for ADMT in use before that date |
| Core duty | Do not use an ADS that discriminates on a protected characteristic; retain ADS data | Give a pre-use notice before ADMT is used for a significant decision; honor access and opt-out rights |
| Record retention | At least four years for employment records including ADS data | Not the same duty; governed by the CCPA generally |
| Who it reaches | Employers with five or more employees in California | Businesses using ADMT for a “significant decision”, employment included |
| Source | California Civil Rights Council rulemaking actions | California Privacy Protection Agency CCPA regulations page |
Neither column substitutes for the other. You can be squarely inside the FEHA rules and still have the January 1, 2027 pre-use notice ahead of you, and it happens the other way round too.
FEHA automated-decision systems — in force since October 1, 2025
FEHA ADS: jurisdiction and source status
- Jurisdiction
- California (statewide)
- Agency
- California Civil Rights Department, Civil Rights Council
- Legal status
- Regulations finalized June 27, 2025 and in force
- Effective date
- October 1, 2025
- Core duty
- The use of an automated-decision system in an employment decision can violate California law where it discriminates, directly or by disparate impact, on a protected characteristic. Covered entities must retain employment records including automated-decision data — machine-learning data and selection criteria among them — for at least four years.
- Applies to
- Employers and covered entities with five or more employees in California
- Last reviewed
- August 26, 2026
- Government source
- California Civil Rights Council rulemaking actions
The four-year retention duty usually lands on operations rather than on counsel. Whatever your workflow captures at send time is what you will still have in 2029. What the four-year ADS retention requirement covers.
CCPA ADMT — pre-use notice due January 1, 2027
CCPA ADMT: jurisdiction and source status
- Jurisdiction
- California (statewide)
- Agency
- California Privacy Protection Agency
- Legal status
- The California Office of Administrative Law approved the CPPA's CCPA regulations package on September 22, 2025; the regulations took effect January 1, 2026.
- Compliance deadline
- A business using ADMT for a significant decision before January 1, 2027 must be in compliance by January 1, 2027. ADMT deployed on or after that date must comply before first use.
- Core duty
- Before using ADMT for a significant decision, provide a notice stating the specific purpose for using the ADMT and how the individual can exercise the applicable rights, including access and opt-out.
- Reaches employment
- The CCPA defines “consumer” to include California residents acting as employees, contractors and applicants.
- Last reviewed
- August 26, 2026
- Government source
- California Privacy Protection Agency CCPA regulations page
The date gets the attention. The harder part is that a pre-use notice has to go out before the tool runs, which means the notice step belongs inside the hiring workflow rather than beside it. What an ADMT pre-use notice has to say.
Go deeper on California
What a pre-use notice must say
The two elements the CPPA regulations name, and where in the workflow the notice belongs.
The four-year retention rule
Which records the FEHA regulations reach, and why the clock is longer than most retention schedules.
What this means for a staffing agency
An agency placing candidates into California roles rarely handles one client's workflow in isolation. One client wants extra review before anything goes out, another wants notices differentiated by role, a third runs everything through a central recruiting desk. Keep those differences in email threads and spreadsheets and the records degrade fast, while the four-year FEHA clock outlasts most of the tools they sit in.
The workable order is usually: decide with counsel which notices are needed and what they say, get that language into an approved, versioned template, put the send inside the workflow rather than beside it, and make sure the delivery event and the template version that produced it stay attached to the candidate record.
The operational side of that, for an agency running one process across several client accounts, is covered separately in Getting a multi-client notice workflow ready before a deadline.
Common questions
When does the California ADMT rule take effect?
The CPPA's CCPA regulations took effect January 1, 2026. For ADMT specifically, a business already using automated decisionmaking technology for a significant decision before January 1, 2027 must be in compliance by that date; ADMT deployed on or after January 1, 2027 must comply before first use.
Does the CCPA ADMT rule apply to employees and job applicants?
The CCPA defines "consumer" to include California residents acting as employees, contractors and applicants, and the CPPA's own materials describe employment as within the "significant decision" category. Whether it reaches a particular workflow is a legal question for your counsel, not one this page answers.
Do the FEHA rules and the CCPA ADMT rules both apply to the same employer?
They are separate regimes with separate agencies, separate triggers and separate dates, and neither one satisfies the other. The FEHA automated-decision system regulations apply to employers with five or more employees in California and took effect October 1, 2025. The CCPA ADMT regulations are administered by the California Privacy Protection Agency.
How long does California require automated-decision data to be kept?
Under the Civil Rights Council's FEHA regulations, covered entities must retain employment records including automated-decision system data — machine-learning data and selection criteria among them — for at least four years.
What does Notice Tracking do about California's requirements?
It runs the workflow. Your counsel decides which requirements reach your roles and approves the wording. Notice Tracking then holds those approved versions, sends the notices, records delivery and failure events as the provider reports them, keeps an append-only history, and produces the export.
January 1, 2027 is the deadline. Building the records takes longer.
Notice Tracking keeps approved template versions, candidate references, send timestamps, provider-returned delivery events and export history connected, so the evidence exists without a reconstruction project.
This page is general information about published government requirements, last reviewed August 26, 2026. Requirements change; confirm the current text with the agency and your own counsel before relying on it.