Coming out of their recent rulemaking meeting, the California Privacy Protection Agency is not surprisingly finding the question of how to regulate the use of ADMT to be a difficult one. While pointing to consumer interest in requiring significant oversight and assessment, the Agency at the same time must grapple with the fact that such assessment could be debilitatingly expensive for many companies. Agency Director Alastair Mactaggart, noting these latter concerns and pointing to Colorado, is lobbying for rules that 1) consider the level of human involvement in the use of such tools, and 2) set company size thresholds that would exempt smaller companies less likely to be able to afford the most onerous requirements.

This is all running parallel to pending legislation that would address these same issues. If passed into law, AB-2930 would require such assessments and would require the CPPA to implement controlling rules.

While these questions will necessarily be addressed by the CPPA at some point, given the disagreement and the fact that there will be another bite at the apple, the final rules are very likely to come later rather than sooner.

Formal rulemaking on risk assessments is still a long way off, as board chair Jennifer Urban said the agency should seek more public comment before making any revisions to the current draft.

www.law.com/...