Over the past two years, the California Privacy Protection Agency (CPPA) has wrestled with drafting regulations on automated decision-making technology: how to define it; the requirements for businesses that use it; and how consumers can exercise their knowledge, access and opt-out data rights. The CPPA has now voted to finalize those rules along with regulations on how businesses should conduct risk assessments. In this guest article, McDermott Will & Schulte attorneys John Ying and Amy Pimentel break down the draft regulations’ key requirements, provide businesses with a roadmap to analyze whether they are in scope, and offer advice on building or updating compliance programs to address new obligations. See “California’s Pending Automated Decision-Making Technology Regulations Will Further Focus Consumers’ Attention on AI” (Feb. 5, 2025).