1. What changes for AI scouting in California?

Does the CCPA cover professional players and applicants?

California privacy rights are not limited to retail customers. The regulator explicitly includes California-resident employees and job applicants. Business coverage depends on statutory conditions and thresholds, so neither a small recruitment department nor a supplier’s overseas headquarters settles the question by itself. (cppa.ca.gov)

For a club, the useful starting point is a workflow inventory, not an inventory of products labelled AI. Record whether a tool retrieves footage, summarises evidence, ranks prospective signings, screens applicants, recommends contract terms or evaluates existing players. Ask counsel which activities and people are covered.

What must be ready by January 2027?

Covered uses of ADMT for significant decisions require preparation before 1 January 2027. The agency identifies employment among the relevant decision areas and describes rights involving notice, access and opting out, subject to the applicable rules and exceptions. (cppa.ca.gov)

The final definition focuses on replacing or substantially replacing human decisionmaking. Qualifying human involvement requires a reviewer who understands the output, evaluates it alongside relevant information, and has authority to change the decision. A nominal approval step should therefore not be treated as sufficient without examining how it works. (cppa.ca.gov)

Recommended supplier acceptance test: give the reviewer a deliberately incorrect player match or unsupported assessment. Require the system to preserve the original evidence, allow correction, record the reviewer’s reasoning and show whether the correction changes downstream recommendations.

Are risk assessments already due?

The risk-assessment timetable is separate from the ADMT timetable. Requirements began in 2026; initial summary submissions and attestations are due by 1 April 2028. The later submission date is not a blanket permission to postpone assessment work. (cppa.ca.gov)

The final rules identify triggers beyond ADMT, including sensitive-information processing and certain systematic-observation profiling of applicants or workers. They require assessment before initiating covered processing, while qualifying processing begun before the regulations took effect has a transition deadline of 31 December 2027. (cppa.ca.gov)

What to request now: a description of input categories, sources, inferred attributes, purposes, retention, recipients, known limitations and safeguards. Do not accept an undifferentiated statement that the supplier is compliant as a substitute for information about the club’s actual workflow.

What employment controls already apply?

California’s separate civil-rights regulations took effect on 1 October 2025. They clarify how existing discrimination protections apply to automated employment systems, require covered employment records—including automated-decision data—to be retained for at least four years, and address assessments that may elicit disability information. (calcivilrights.ca.gov)

Procurement implication: reconcile deletion functionality with counsel-approved record-retention and legal-hold rules. Specify which decision records must remain exportable when a scouting subscription ends; do not promise either indefinite retention or immediate deletion of everything.