CCPA ADMT Rules and Telehealth Eligibility Quizzes

California's ADMT regulations apply to healthcare: a business that uses automated decisionmaking technology (ADMT) to make a decision that results in the provision or denial of healthcare services must comply by January 1, 2027 (CCPA regulations). A telehealth quiz that decides on its own who can book or get treatment may be in scope, unless its data is exempt as HIPAA protected health information or California medical information. Curve Forms, from Curve Compliance, hosts intake and lead forms under the BAA Curve signs on every plan, with the ad click attached to each lead.

Book a call. See how Curve Forms collects telehealth intake under a BAA and puts every lead, with its ad click, in your team's Leads inbox. Book a call with Curve.

What the ADMT rules cover

CalPrivacy's Board adopted the rules on July 24, 2025, the Office of Administrative Law approved them on September 22, 2025, and the regulations took effect January 1, 2026 (CalPrivacy). The ADMT article has its own date. Section 7200(a) says "A business that uses ADMT to make a significant decision concerning a consumer must comply with the requirements of this Article," and 7200(b) says one already doing so "must be in compliance with the requirements of this Article no later than January 1, 2027" (CCPA regulations). The rules bind a CCPA "business": a for-profit company that does business in California and meets one of the thresholds in Civil Code 1798.140(d) (CCPA text).

The definition is not limited to AI. ADMT is "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking." To substantially replace means the business "uses the technology's output to make a decision without human involvement." Human involvement requires a reviewer who can "Know how to interpret and use the technology's output to make the decision," "Review and analyze the output of the technology," and "Have the authority to make or change the decision" (section 7001(e), CCPA regulations). Tools such as "calculators, databases, and spreadsheets" are excluded "provided that they do not replace human decisionmaking."

Healthcare services, and what advertising is not

A "Significant decision" means "a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services" (section 7001(ddd), CCPA regulations). Healthcare services are "services related to the diagnosis, prevention, or treatment of human disease or impairment, or the assessment or care of an individual's health."

The same definition draws a line around marketing: "Significant decision does not include advertising to a consumer." Choosing which ad or marketing email someone sees is not a significant decision under these rules. Deciding whether they can get care is the part to look at. Oklahoma's new law, effective the same day, also lets consumers opt out of profiling for decisions on "housing, insurance, or health care services" (SB 546; see Oklahoma and Louisiana privacy laws).

The HIPAA and medical-information exemption

Civil Code 1798.146 says the CCPA "shall not apply" to "Medical information governed by the Confidentiality of Medical Information Act" or to "protected health information that is collected by a covered entity or business associate" under the HIPAA rules (CCPA text). It also exempts a covered entity or business associate "to the extent" it handles patient information "in the same manner as medical information or protected health information."

So the first question for a telehealth quiz is whose data it is. Answers collected by a covered telehealth provider, or by its business associate, are likely PHI and sit under HIPAA instead. A brand that runs the quiz outside those roles may hold personal information the CCPA still covers. Where your quiz falls depends on your corporate structure and contracts, so talk to your counsel. For the line between the two kinds of data, see PHI vs PII in healthcare marketing, and for California's medical privacy law, CMIA and CCPA for healthcare marketing.

Quizzes that decide vs quizzes that route to a clinician

The rules turn on what the quiz does with the answers, not on what it looks like. Each row quotes the definition that bears on that design.

Quiz design	What the regulations say
The quiz output alone approves or declines someone for a visit or a prescription	ADMT covers technology that uses computation "to replace human decisionmaking," and a significant decision includes the "denial of" healthcare services (CCPA regulations)
The quiz scores answers, and a clinician reviews them and decides	Human involvement needs a reviewer who can "Review and analyze the output of the technology, and any other information that is relevant to make or change the decision" and has "the authority to make or change the decision" (CCPA regulations)
The quiz picks which ad or marketing email a person sees	"Significant decision does not include advertising to a consumer." (CCPA regulations)
The form collects answers for a clinician's visit and decides nothing	ADMT must "replace human decisionmaking or substantially replace human decisionmaking" (CCPA regulations)

For where quiz funnels carry other compliance risk, see GLP-1 quiz funnels: where compliance risk sits and telehealth eligibility screening forms.

Notices, opt-outs and access the rules require

• A Pre-use Notice. It must be shown "at or before the point when the business collects the consumer's personal information that the business plans to process using ADMT," with "A plain language explanation of the specific purpose" (section 7220, CCPA regulations).
• An opt-out, or a human appeal. "A business must provide consumers with the ability to opt-out of the use of ADMT to make a significant decision concerning the consumer," unless it offers "a method to appeal the decision to a human reviewer who has the authority to overturn the decision" (section 7221, CCPA regulations).
• An opt-out link for online businesses. At minimum, "an interactive form accessible via an opt-out link that is provided in the Pre-use Notice" (section 7221(c)(1), CCPA regulations).
• Not a cookie banner. "A notification or tool regarding cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting requests to opt-out of the business's use of ADMT" (section 7221(c)(4), CCPA regulations).
• Access on request. A business "must provide a consumer with information about this use when responding to a consumer's request to access ADMT" (section 7222(a), CCPA regulations).
• A risk assessment. "Using ADMT for a significant decision concerning a consumer" is one of the activities that requires one (section 7150(b)(3), CCPA regulations). See CCPA risk assessments for health advertisers.

Other states have their own automated decision rules; see the Colorado AI Act for healthcare marketing.

How Curve Compliance helps

Curve Forms gives telehealth teams hosted intake. Every form is hosted by Curve under the BAA Curve Compliance signs on every plan, so a submission never passes through a third-party form tool. Logic shows or hides fields based on earlier answers. Statement fields carry notice text on the form itself, and separate checkboxes record privacy consent and marketing consent.

Every lead arrives in the Leads inbox with its answers, UTMs and ad click ID, attribution and staff notes, and your team moves it through lead stages such as qualified and converted. Form events reach Meta, Google Ads and your other destinations server-side through your event mappings, and form answers, page titles and free text are never sent. Curve strips PHI before data reaches an ad platform, is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For opt-out signals on the rest of your site, see Global Privacy Control for clinic sites.

Sources, checked October 26, 2026: CCPA regulations, effective January 1, 2026 (CalPrivacy); CalPrivacy, ADMT and risk assessment rulemaking; CCPA statute, effective January 1, 2026 (CalPrivacy); Oklahoma SB 546, enrolled.

Frequently Asked Questions

Does the CCPA ADMT rule apply to healthcare?

Yes. A significant decision includes the provision or denial of healthcare services, so a business that uses ADMT for one must comply by January 1, 2027, unless the data is exempt, such as PHI collected by a HIPAA covered entity or business associate (CCPA regulations; 1798.146).

Is an eligibility quiz automated decisionmaking?

It can be. ADMT is "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking" (CCPA regulations). A quiz whose output decides on its own is closer to that line than one a clinician reviews with authority to change the result.

Does ADMT cover ad targeting?

No. The regulations say "Significant decision does not include advertising to a consumer" (CCPA regulations). Selling or sharing data for ads raises other CCPA duties, such as honoring opt-out signals.

Are HIPAA-covered telehealth companies exempt?

Their PHI is. The CCPA does not apply to "protected health information that is collected by a covered entity or business associate," or to CMIA medical information (1798.146). Data a company holds outside those exemptions can still be covered.

When do businesses have to comply with the ADMT rules?

A business that used ADMT for a significant decision before January 1, 2027 must comply "no later than January 1, 2027"; one that starts later must comply whenever it uses ADMT for a significant decision (section 7200(b), CCPA regulations).

Is a cookie banner enough for an ADMT opt-out?

No. The regulations say a cookie banner or cookie controls are "not by itself an acceptable method" for opting out of ADMT; an online business needs an opt-out link to an interactive form (section 7221(c), CCPA regulations).

Does Curve Compliance sign a BAA?

Yes. Curve Compliance signs a BAA on every plan and hosts Curve Forms under it, and it strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week.

Talk to Curve Compliance

Book a call. See Curve Forms for telehealth intake under a BAA, with every lead in your team's Leads inbox, and server-side conversions with PHI removed before anything is sent to an ad platform, under the BAA Curve Compliance signs on every plan. Book a call with Curve.