The California Privacy Protection Agency (CPPA) held a board meeting on April 4, 2025, where a central point of discussion during the occasionally contentious five hour meeting revolved around the proposed regulations concerning the use of artificial intelligence, referred to as automated decision-making technology (ADMT), in the context of targeted advertising. As advocates for a thriving ecommerce ecosystem and the responsible use of technology, our association has closely monitored these developments. We are encouraged by the recent discussions that signal a shift towards a more balanced regulatory landscape in California, one that fosters innovation while upholding the fundamental principles of consumer privacy as intended by the California Consumer Privacy Act (CCPA).
The proposed regulations, as initially drafted, sought to extend significant obligations, including mandatory risk assessments and pre-use notices with opt-out rights, to businesses engaging in profiling for behavioral advertising, encompassing even first-party advertising aimed at their own customers. This broad approach raised considerable concerns within the business community, as articulated by various stakeholders during the public comment period and at the board meeting itself.
A key argument voiced, and one that resonates deeply with our association’s mission, centered on the idea that the proposed ADMT regulations appeared to venture beyond the scope of a privacy statute and into the realm of general AI regulation, an area where the legislature and the Governor are already actively engaged. Board member Worthy expressed concerns that the proposed rules might overreach the intent of the CCPA. Many in the business community echoed these sentiments, fearing that the expansive scope of the regulations would impose unnecessary burdens and costs, potentially stifling innovation, leading to job losses, and diverting capital away from crucial investments.
Specifically regarding the behavioral advertising threshold, concerns were raised about its potential impact on the ability of businesses, particularly small and medium-sized enterprises, to effectively advertise their own products and services to their existing customer base. As board member McTaggert pointed out during the meeting, the initial interpretation could have inadvertently hindered even basic first-party advertising, a cornerstone of direct-to-consumer engagement. The distinction between contextual advertising (which was clarified as being outside the scope) and behavioral advertising became a focal point, with many arguing that responsible first-party targeted advertising, utilizing data a consumer has willingly shared with a business, does not inherently present the significant privacy risks that warrant such extensive regulatory mandates.
Moreover, the argument was made that consumers already possess rights under the CCPA to opt out of the selling or sharing of their personal information, including for cross-context behavioral advertising. Imposing an additional layer of ADMT-specific regulations on first-party behavioral advertising seemed duplicative and potentially confusing for both businesses and consumers.
During the April 4th meeting, the CPPA board engaged in a thoughtful discussion of these concerns, carefully considering the public comments received. This led to a significant development: a proposal to remove the behavioral advertising threshold entirely from both the risk assessment and the ADMT framework. Staff acknowledged the substantial feedback from the public and the desire to simplify implementation at this stage. This proposed removal signifies a potential recognition by the Board of the need to calibrate the regulations more precisely to genuine privacy risks, avoiding the creation of undue obstacles for businesses to connect with their customers in a responsible manner.
Public commenters at the meeting, representing a broad spectrum of the business community, voiced their strong support for this proposed direction. They emphasized the importance of allowing businesses to continue engaging in first-party advertising and lauded the Board’s responsiveness to their concerns.
While the discussions are ongoing and the final shape of the regulations remains to be seen, the proposal to remove the behavioral advertising threshold is a positive indication. It suggests a willingness by the CPPA to strike a more appropriate balance between safeguarding consumer privacy and fostering a dynamic and innovative ecommerce environment. Our association remains committed to working constructively with the CPPA and other stakeholders to ensure that any final regulations are clear, practical, and aligned with the original intent of the CCPA, allowing for the continued responsible use of AI and ADMT to benefit both businesses and California consumers. We believe that by focusing on regulations that address demonstrable and significant privacy risks, the CPPA can best fulfill its mandate without inadvertently hindering economic growth and innovation in the state.
