California — CCPA/CPRA and the CPPA Automated Decisionmaking Technology (ADMT) rules
What it asks of employers
- Tell candidates what you collect, at the moment you collect it. When you collect a candidate's information (or before), tell them the kinds of data you collect, why, how long you keep it, and whether you sell or share it.
- Fix inaccurate candidate information when asked. When a candidate says information about them is wrong, correct it — in your applicant tracking system if the record is there, or by asking Amp to update information held in Amp, which Amp does through support on request.
- Tell candidates before you screen them with automated tools. Before you use automated technology to screen or rank a candidate for a hiring decision, give them a plain-language notice that you're using it, how to opt out or ask for a review, and how to learn the way it works. This applies starting January 1, 2027.
- Let candidates opt out of automated screening (or use the hiring exception). Let candidates ask you to stop screening them with automated tools, and stop within 15 business days of their request — unless you qualify for the hiring exception or instead offer them a review by a person. This applies starting January 1, 2027.
- Explain an automated decision when a candidate asks. If a candidate asks how an automated tool reached a decision about them, explain what it was used for, how it works, what it produced, and how much that result affected your decision. This applies starting January 1, 2027.
- Do a risk assessment before using automated hiring decisions. Before you use automated technology to make a significant hiring decision, conduct and document a risk assessment that weighs its benefits against the risks to candidates, and submit the required attestation to the state privacy agency on its timeline. Amp's evidence package supports this assessment. This applies starting January 1, 2027.
What Amp does
- Amp answers candidate requests to see their personal information. When a candidate asks what personal information you've collected about them, Amp gathers the categories of data, where it came from, why it's used, and the specific pieces — on your behalf.
- Amp carries out candidate deletion requests. When a candidate asks to have their data deleted, Amp erases their candidate data and passes the request on to the other services that received it.
- Amp keeps candidate data only as long as your policy allows. Amp follows your organization's data-retention policy so candidate information isn't kept longer than needed for the purpose it was collected for.
- Amp bias-tests scoring and applies it consistently. Every candidate for a role is scored on the same job-related criteria, and that scoring is regularly tested for bias across demographic groups. This helps you rely on the hiring exception that lets you use automated screening without offering an opt-out.
- Evidence package for your automated-hiring risk assessment. Amp can produce a tamper-evident evidence package that documents how the scoring works, which supports the risk assessment you must do for automated hiring decisions and helps you explain how an automated evaluation was reached.