Source: The National Law Review

AI-driven hiring tools process substantial personal information about job applicants, including resume data, video interview analyses, automated assessments, and scoring against job-fit criteria. The California Consumer Privacy Act (CCPA) updates require certain processing activities to be preceded or accompanied by a formal risk assessment. Notably, Automated Decision-Making Technology (ADMT) that makes or substantially contributes to “significant decisions” about consumers—such as employment opportunities or compensation—triggers an obligation for risk assessment. AI tools that rank, score, or eliminate candidates may therefore require such evaluation irrespective of the presence of human reviewers later in the process.

The updated CCPA regulations also identify systematic observation of job applicants as a trigger for risk assessment. This includes video or audio recording, live-streaming, and technologies enabling physical or biological identification or profiling. AI hiring tools that analyze facial expressions, speech patterns, or conduct automated screening interviews perform such observation. Businesses subject to the CCPA and employing these technologies should assess their AI tools’ functionalities and the personal information they process to determine whether a risk assessment is required.