California’s AI in Advertising: ADMT Obligations for Marketing Technology Platforms

The advertising technology industry has operated in a state of regulatory flux for years, navigating CCPA opt-out requirements, cross-context behavioral advertising restrictions, and an ongoing series of CPPA enforcement signals. With California’s final ADMT regulations now in effect as of January 1, 2026, many advertising technology companies assumed — with some relief — that they had cleared the hardest hurdle. After all, the final regulations explicitly excluded advertising from the definition of “significant decisions,” sparing adtech from the most demanding ADMT compliance requirements.

That relief is only partially warranted. The regulatory picture for AI-powered advertising, targeting, and personalization is more nuanced than the “advertising is excluded” headline suggests. California has crafted a framework that exempts behavioral advertising from the ADMT significant-decision rules while simultaneously imposing meaningful risk assessment obligations on advertising-related processing, maintaining restrictions on certain profiling activities, and preserving a specific opt-out exception gap for behavioral advertising profiling that operators need to understand carefully.

This post is a practical guide for marketing technology platforms, demand-side platforms, data management platforms, advertising networks, and in-house adtech teams. It covers what California’s ADMT regulations actually require of advertising technology, where the obligations fall, and what compliance looks like for companies building or operating AI-powered advertising systems.

The Headline: Advertising Is Not a “Significant Decision” — What That Means

The most consequential regulatory decision the CPPA made in finalizing the ADMT regulations was to exclude behavioral advertising from the definition of “significant decisions.” This exclusion determines which businesses must provide pre-use notices, offer opt-out rights specifically for ADMT under the new rules, and submit to the ADMT consumer rights access regime.

“Significant decisions” under the regulations are defined as decisions that produce legal or similarly significant effects on consumers in the following areas: finances, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, healthcare services, and access to insurance. Advertising and marketing are not on this list.

This means that if your company uses an AI model solely to determine which ad to show a user, optimize bidding for ad inventory, or personalize content recommendations for advertising purposes, you are not operating a “significant decision” ADMT system under the California regulations. The specific ADMT obligations — pre-use notice, opt-out rights for significant decisions, and access rights to ADMT logic — do not apply to your advertising AI.

This is a meaningful protection for the adtech industry. An earlier draft of the regulations had included advertising within the significant decision framework, which would have required advertising platforms to provide opt-out mechanisms specifically for ADMT-driven ad targeting. The industry commented vigorously against this, and the CPPA ultimately agreed that advertising decisions do not rise to the same level of legal significance as employment, credit, or healthcare decisions.

But this is where the “not quite a free pass” part of the analysis begins.

The Risk Assessment Obligation: Where Advertising Technology Is Directly Covered

While behavioral advertising escapes the ADMT significant-decision rules, it does not escape California’s risk assessment requirements. The CCPA regulations that took effect January 1, 2026 impose mandatory risk assessments on businesses that engage in processing activities that present a “significant risk” to consumers’ privacy. The list of significant-risk processing activities includes activities central to advertising technology business models.

Processing activities that trigger risk assessment obligations include:

1. Selling or sharing personal information — including the use of third-party ad-tech, pixels, tracking scripts, and behavioral data syndication for targeted advertising purposes. The CPPA has previously flagged cookies, pixels, and other technologies that automatically send consumer behavioral data to third parties as potentially constituting “selling or sharing” under the CCPA. If your platform shares behavioral data with advertisers, DSPs, or data brokers for targeting purposes, you are likely selling or sharing personal information and must complete a risk assessment.

2. Processing sensitive personal information — a category that includes health information, financial information, precise geolocation, racial or ethnic origin, sexual orientation, and other categories. Many advertising datasets contain or can be used to infer sensitive attributes. Lookalike modeling, interest-segment targeting, and audience enrichment can all implicate sensitive personal information depending on the underlying data.

3. Using automated processing to infer or extrapolate a consumer’s characteristics — including intelligence, ability, aptitude, economic situation, personal preferences, interests, predispositions, or behavior. This is the provision most directly relevant to AI-powered audience profiling: if your system builds or uses profiles that infer consumer attributes to serve advertising, you are using automated processing to infer characteristics, and that triggers the risk assessment requirement.

4. Processing personal information intended to train ADMT for a significant decision — if you are using consumer data to train models that will later be used for significant decisions (not advertising), the training data processing itself triggers a risk assessment obligation.

The practical implication: the vast majority of data-driven advertising platforms will have at least one risk-assessment-triggering processing activity. A platform that runs behavioral retargeting using third-party pixel data, builds audience segments using behavioral attributes, and uses machine learning to optimize targeting is engaged in multiple risk-assessment-triggering activities simultaneously.

What a Risk Assessment Must Cover for Advertising Technology

California’s risk assessment regulations are substantive. A compliant risk assessment is not a checkbox or a legal disclaimer — it is a documented analysis of benefits, risks, and mitigations. For advertising technology companies, the assessment must address:

Processing Purpose and Benefits: What business purpose does the processing serve? The assessment must articulate the benefits to the business and, if applicable, to the consumer, including economic benefits, consumer experience improvements, and operational efficiencies.

Categories of Personal Information Processed: What data is being processed, by whom, and in what contexts? For adtech, this requires a genuine data inventory: first-party behavioral data, third-party data purchases, pixel-derived event data, contextual signals, and any inferred attributes.

Risks to Consumers: The assessment must identify risks including:
– Privacy intrusion (excessive data collection, unexpectedly sensitive inferences)
– Discrimination (differential ad targeting based on protected characteristics, housing or credit ad targeting that may implicate Fair Housing Act or ECOA concerns)
– Manipulation (using behavioral profiling to exploit psychological vulnerabilities)
– Security risks to the data being processed

Weights and Tradeoffs: The regulations require that the business weigh benefits against risks. This is an explicit cost-benefit analysis that must be documented. Businesses must explain why they concluded the processing is appropriate given the risks.

Mitigations: The assessment must identify the specific measures implemented to mitigate identified risks. For advertising technology, this includes data minimization practices, retention limits, access controls, consent mechanisms, opt-out mechanisms, and technical controls limiting inference of sensitive attributes.

Documentation and Submission: Risk assessments must be completed before initiating new significant-risk processing (for processing beginning on or after January 1, 2026) and by December 31, 2027 for processing already underway before January 1, 2026. A summary and attestation must be submitted to the CPPA by April 1, 2028 (for businesses with revenue over $100 million in 2026), April 1, 2029 (for $50–100 million), or April 1, 2030 (for under $50 million).

The Opt-Out Exception Gap: Behavioral Advertising Profiling

Here is the piece of the ADMT framework that advertising technology companies need to read carefully. The regulations contain a specific provision about what exceptions are available when consumers exercise opt-out rights — and the exception structure works differently for behavioral advertising profiling than for other ADMT uses.

For ADMT used in significant decisions, the regulations allow businesses to offer an alternative human review process instead of honoring an opt-out request — essentially, if you offer a meaningful human alternative, you can retain the option to use ADMT. This exception is designed to prevent ADMT opt-outs from creating situations where the only alternative is to refuse service entirely.

The regulations state explicitly that this human-review exception does not apply to ADMT used for profiling for behavioral advertising. Nor does it apply to the use of consumers’ personal information for training ADMT.

Read carefully, this provision creates a specific gap: while advertising is excluded from the significant-decision regime (so the ADMT opt-out rights do not apply in the first place), if a business is running ADMT that falls within the significant-decision category AND is also profiling for behavioral advertising as part of that process, the human-review exception cannot be invoked to avoid the opt-out obligation for the behavioral advertising component.

More practically: this provision signals the CPPA’s intent to prevent the human-review exception from being used as a backdoor around consumer rights specifically for behavioral advertising. Even if the current framework does not directly impose opt-out obligations on advertising-only processing, companies should not assume that this boundary is permanent or that it forecloses future regulatory action targeting behavioral advertising more directly.

The CCPA’s Existing Opt-Out Framework for Advertising

The ADMT regulations do not operate in a vacuum. Advertising technology is already subject to California’s established opt-out framework for the sale and sharing of personal information, and the AI-specific provisions layer onto that existing regime.

Under the CCPA as amended by the CPRA, consumers have the right to opt out of the “sharing” of their personal information for cross-context behavioral advertising — defined as the targeting of advertising based on personal information obtained from activity across businesses, websites, applications, or services. This opt-out right applies regardless of whether artificial intelligence is involved. The “Do Not Sell or Share My Personal Information” or “Do Not Share My Personal Information” link required on California-facing websites captures this right.

AI-powered advertising systems that rely on cross-context behavioral data to train targeting models or to make real-time targeting decisions are operating on data streams that consumers can opt out of. When a consumer exercises the sharing opt-out:

• The business must stop using that consumer’s personal information for cross-context behavioral advertising
• The business cannot sell the consumer’s data to data brokers, advertising networks, or DSPs for targeting purposes
• The business cannot use the consumer’s cross-context behavioral data to train advertising AI models

The obligation applies to the data itself, not just the advertising decision. A company that processes opted-out consumer data through an AI targeting system, even if it claims the AI makes the final decision, is violating the consumer’s opt-out right.

Service Provider and Contractor Distinctions: Advertising technology often operates through layered relationships — publishers use SSPs, advertisers use DSPs, both connect through ad exchanges, and data enrichment happens through data management platforms. The CCPA’s rules about service providers and contractors govern whether data processed in these relationships constitutes “selling or sharing.” Ad tech companies that receive data only for the purpose of providing services to a covered business under appropriate contractual terms can qualify as service providers or contractors — but the contract must prohibit use of the data beyond the service purpose, and the data cannot be combined with data from other sources or used to train models outside the scope of the service agreement.

Specific Implications for Different Adtech Business Models

Demand-Side Platforms (DSPs): DSPs that bid on inventory using audience segments built from behavioral data are engaged in processing personal information (even if they only see pseudonymous identifiers) for cross-context behavioral advertising. Risk assessment obligations apply to the processing of behavioral data. DSPs should ensure that contracts with data suppliers address CCPA compliance, that data ingested from third parties was collected with appropriate notice and opt-out rights, and that opted-out consumer records are honored and not rebid on.

Data Management Platforms (DMPs): DMPs that aggregate behavioral data and build audience profiles are squarely within the risk assessment obligations. Using AI to build lookalike audiences, infer interest categories, or enrich profiles with probabilistic attributes triggers the “automated processing to infer or extrapolate consumer characteristics” requirement. DMPs need risk assessments covering their modeling activities and must have mechanisms to propagate consumer opt-out signals to downstream platforms.

Customer Data Platforms (CDPs) with AI Personalization: First-party CDPs that build individual profiles and use AI to personalize communications and offers exist in a more nuanced position. First-party data processing generally does not constitute “selling or sharing” — but if the CDP exports audiences or profile attributes to third-party advertising platforms, that export likely constitutes sharing. AI personalization based solely on first-party data and delivered through first-party channels carries lower CCPA risk than third-party syndication. Even so, risk assessments are likely required for any AI-driven profiling or inference.

Retail Media Networks: Retailers that have built advertising networks using their first-party purchase and browsing data face a particularly complex analysis. The first-party data is legitimate; the advertising placements on retail properties are permissible. The risk arises when retail media networks share consumer data with brand advertisers or allow brands to match their own customer lists to the retailer’s data for off-site targeting. That data sharing is likely “sharing” under the CCPA and requires both opt-out mechanisms and risk assessments.

Social Media and Content Platforms: Platforms that serve advertising based on user behavior and profile data have both first-party and third-party advertising data flows. AI-driven feed ranking, content recommendations, and ad targeting all involve automated inference about consumer preferences and behaviors. Risk assessments covering these activities are required. Platforms should also review their AI training practices — using consumer personal information to train targeting AI requires a risk assessment covering that training activity.

Building Compliant AI Advertising Systems: A Practical Framework

For marketing technology companies building or operating AI advertising systems in California, the following framework addresses the key compliance obligations:

1. Data Inventory and Mapping
Before you can complete risk assessments or honor opt-out requests, you need to know what data flows through your systems. Map every data input to your advertising AI: source, category, whether it constitutes sharing, and what processing it undergoes.

2. Opt-Out Mechanism Implementation
Ensure your systems honor CCPA sharing opt-outs in real time. Consumer opt-out status must be propagated across your stack so that opted-out consumers’ data is not used for cross-context behavioral advertising. This is a technical obligation, not just a policy one.

3. GPC Signal Recognition
California businesses (and those operating under New Hampshire, Montana, and other state laws) must recognize Global Privacy Control signals as opt-out requests. Your advertising systems must be able to receive and act on GPC signals from browsers without requiring consumers to manually opt out through a separate mechanism.

4. Risk Assessment Program
Establish a documented risk assessment program for advertising AI. Each material advertising AI system or new data processing activity requires its own assessment. Assessments must identify risks, weigh benefits against risks, and document mitigations. Complete assessments for existing processing by December 31, 2027; complete assessments for new processing before initiating it.

5. Service Provider and Contractor Agreements
Review and update your data processing agreements with publishers, advertisers, data suppliers, and downstream platforms. Agreements must comply with CCPA service provider or contractor requirements and must not permit use of California consumer data beyond the scope of the stated service.

6. Training Data Governance
If you are using consumer personal information to train advertising AI models, that training activity requires a risk assessment. Establish a training data governance process that documents the data used, the purpose of training, and the protections applied.

7. Cybersecurity Audit Preparation
If your annual revenue exceeds $50 million, California’s new cybersecurity audit requirements will apply to your processing. The first audits are due in 2028–2030 depending on revenue. Build toward audit-readiness now.

The Regulatory Trajectory

The CPPA made a deliberate choice in 2025 to exclude advertising from the significant-decision ADMT framework. That decision reflects a pragmatic judgment that behavioral advertising, while privacy-invasive, does not produce the same type of irreversible harm to individual life opportunities as being denied a loan or losing a job.

But the CPPA has not abandoned regulatory interest in advertising AI. The risk assessment framework, the opt-out gap for behavioral advertising profiling, and the ongoing enforcement posture around sharing opt-outs signal continued regulatory focus. The CPPA has pursued enforcement in the advertising context before — most notably signaling that pixel-based data sharing without opt-out mechanisms violates the CCPA.

For advertising technology companies, the message is clear: the significant-decision carveout is real and provides genuine compliance relief for advertising-only AI systems. But it does not eliminate California privacy compliance obligations. Risk assessments, opt-out mechanism compliance, data processing agreements, and GPC recognition all remain live requirements that must be met.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.