California's four-year ADS record retention requirement
The headline in California's FEHA automated-decision system rules is discrimination. The duty that actually lands on operations is retention: employment records, including automated-decision data, kept for at least four years. That is longer than a lot of the systems those records currently live in.
The requirement
Jurisdiction and source status
- Jurisdiction
- California (statewide)
- Agency
- California Civil Rights Department, Civil Rights Council
- Legal status
- Regulations finalized June 27, 2025 and in force
- Effective date
- October 1, 2025
- Retention duty
- Employers and covered entities must maintain employment records, including automated-decision data, for a minimum of four years — with ADS data, including machine-learning data and selection criteria, retained for at least four years.
- Applies to
- Employers and covered entities with five or more employees in California
- Last reviewed
- August 26, 2026
- Government source
- California Civil Rights Council rulemaking actions
What “ADS data” reaches
The regulations name machine-learning data and selection criteria explicitly, which reaches further than the notice itself. The practical question is what a reviewer would need four years from now to understand what happened to a given candidate. Usually that is more than any one of your systems holds today.
At minimum, teams tend to find they need the candidate reference, the role or workflow reference, which automated tool was involved, the approved notice version that was actually used, the send timestamp, the provider-returned delivery outcome, and the history of who changed what along the way.
Why four years is the hard part
Legally, four years is unremarkable. Operationally it is a long time. Over four years a staffing agency will typically change at least one system in the chain, revise its notice language several times, and lose the people who remember why a particular decision was made. Retention duties are usually breached by attrition rather than by anyone deciding to delete something.
Three specific pressures show up:
- Template drift. Language gets revised. If the sent copy is not pinned to a version, the archive shows today's wording rather than what the candidate actually received.
- System turnover. Records inside a tool the agency no longer uses are records the agency can no longer produce on demand.
- Silent delivery failures. A bounce that nobody recorded looks identical, four years later, to a notice that arrived.
What a defensible record looks like
A defensible record is one that answers the question without a reconstruction project: what was sent, to whom, under which approved version, when, and what the delivery provider returned.
Two properties make the difference over a four-year window. The history has to be append-only, so a later edit cannot quietly rewrite what the record said at the time. And the record has to be exportable in a structured form, so it survives the system that produced it.
Common questions
How long must California employers keep automated-decision system data?
At least four years. Under the Civil Rights Council's FEHA regulations, covered entities must maintain employment records including automated-decision data — machine-learning data and selection criteria among them — for a minimum of four years.
Which employers does the four-year rule apply to?
The FEHA automated-decision system regulations apply to employers and covered entities with five or more employees in California. They took effect October 1, 2025.
Is this the same as the CCPA ADMT requirement?
No. The four-year retention duty comes from the Civil Rights Council's FEHA regulations. The CCPA ADMT pre-use notice comes from the California Privacy Protection Agency and is a separate regime with a separate January 1, 2027 deadline.
Notice Tracking keeps approved templates, delivery events and exports connected to the candidate record.
This page is general information about published government requirements, last reviewed August 26, 2026. Requirements change; confirm the current text with the agency and your own counsel before relying on it.