Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 09 DECEMBER 2025

CCPA Finalizes Rules On Implicit Bias Risks & Cyber Security Audits In Financial Services Automation

Madison Law
Explore more from Madison Law

On July 24, 2025, California regulators approved a number of regulations under the California Consumer Privacy Act (CCPA) governing the use of automated decision-making technology (ADMT).

United StatesConsumer Protection
Alexis A. Jugan
Alexis A. Jugan

On July 24, 2025, California regulators approved a number of regulations under the California Consumer Privacy Act (CCPA) governing the use of automated decision-making technology (ADMT). The rules impose new obligations around pre-use notices, opt-out rights, risk assessments, and cybersecurity audits. These regulations carry particular significance for financial services companies, where automated lending and credit decision tools raise serious concerns about implicit bias. On September 23, 2025, the California Office of Administrative Law (OAL) announced that it had approved the regulations proposed by the California Privacy Protection Agency (CPPA). With the implementation of these new regulations, it is crucial for financial institutions to evaluate their use of ADMT and ensure compliance.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

New York City’s Click-to-Cancel Rule: What Businesses Need To Know

New York City has enacted the nation's first municipal click-to-cancel rule, requiring businesses to provide clear disclosures, simple cancellation processes, and advance renewal notices for subscription services. With approximately 30 states already implementing similar regulations and the federal landscape in flux following the FTC's vacated rule, companies now face an increasingly complex patchwork of compliance obligations. The rule takes effect October 1, 2026, and imposes penalties ranging from $525 t
United StatesConsumer Protection
Skadden, Arps, Slate, Meagher & Flom LLP
Skadden, Arps, Slate, Meagher & Flom LLP
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Amway To Pay $225 Million Over Alleged False Earnings Claims And Fabricated Sales

The FTC and Washington state secured a record $225 million settlement from Amway and affiliated groups over allegations they misled recruits about earnings potential while pressuring them to buy products with little retail opportunity. The complaint reveals that over three-quarters of U.S. product volume was sold to IBOs themselves rather than retail customers, with fabricated sales reporting masking the recruitment-driven model. The settlement's injunctive provisions establish new standards for earnings cl
United StatesConsumer Protection
Frankfurt Kurnit Klein & Selz PC
Frankfurt Kurnit Klein & Selz PC
Article

FTC Asks Whether Platform Ad Tools Fuel Impersonation Scams

The Federal Trade Commission is exploring whether digital platforms should bear greater responsibility for preventing impersonation ads that falsely pose as legitimate businesses or government agencies. Through an Advance Notice of Proposed Rulemaking, the agency seeks public input on potential amendments to its existing Impersonation Rule, examining how ad-optimization tools and platform practices...
United StatesConsumer Protection
Greenberg Traurig
Greenberg Traurig
Article

CONGRESS FIRES BACK?: New Bill Seeks To Revive Written Consent Rule Under TCPA

Congress has introduced the Stop Spam Calls Act, directing the FCC to revise the definition of prior express written consent under the TCPA to require one-to-one seller consent and logical relevance between sellers and website content. This legislative move comes as the Fifth Circuit questions whether written consent is even required under the TCPA, creating a fascinating tension between congressional intent and judicial interpretation that could reshape telemarketing compliance.
United StatesConsumer Protection
Troutman Amin LLP
Troutman Amin LLP
Article

The Coming State-Law Litigation Wave Of 2026-27: “Subscription Trap” Class Actions

State-law class actions targeting automatic renewal and subscription practices are accelerating, creating significant litigation risk for companies that rely on recurring revenue models. Recent settlements demonstrate that even technical compliance failures can lead to seven-figure exposure, with California, Illinois, and Virginia statutes driving the most aggressive litigation.
United StatesConsumer Protection
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

NCAA Enjoined From Enforcing New Fifth-Year Eligibility Rule

A federal court has issued a nationwide injunction blocking the NCAA from enforcing its new five-year eligibility rule against Division I athletes who graduated high school in 2022. The ruling creates immediate compliance challenges for athletic departments as they navigate roster management, revenue-sharing caps, and potential penalties while the NCAA appeals the decision.
United StatesConsumer Protection
Buchanan Ingersoll & Rooney
Buchanan Ingersoll & Rooney