Eightfold's 0-to-5 Score Is in Court. Jan. 1, Californians Can Ask Why

Most rejections come with no reason, and if a model ranked you, nobody was ever going to tell you. That changes on January 1, 2027. From that date, California applicants can make a large employer explain how its automated hiring tool processed their application and what the employer did with the result. The right only pays off if you ask precisely and keep the records that prove which application you mean.

This piece covers the access right: what you can demand, when to send the request, and how to word it so you get something better than a form letter. Opting out is a separate topic.

What changes for job applicants on January 1, 2027?

From January 1, 2027, covered California employers that use automated decisionmaking technology (ADMT) for significant decisions such as hiring must give notice when they use it, respond to access requests, and let you opt out unless an exception applies. A rejection counts as an "adverse significant decision" under the rules.

These are the points that matter for CCPA automated decisionmaking and job applicants:

• Who's covered: for-profit employers with more than $25 million in annual gross revenues that do business in California. DataGrail puts the current figure at about $26.6 million. Startups below that line are outside the rule.
• What's covered: tools the employer already runs, not only new ones. The duties apply "including to ADMT already in use," so a ranking system your target employer installed years ago counts.
• Who enforces it: the California Privacy Protection Agency (CalPrivacy) and the Attorney General. You can't sue an employer directly over an ADMT violation, and that gap shapes everything below.

Colorado's SB 26-189 starts the same day. Gov. Polis signed SB 189 on May 14, 2026, which pushed the effective date from June 30, 2026 to January 1, 2027. Skadden notes the date holds only if the Colorado attorney general finishes the required rulemaking by then.

Why the access right matters more than the opt-out

The access right is the one employers can't swap out. An employer can skip the opt-out if an exception applies, such as a human appeal process. Nothing in §7222, the access provision, lets it substitute anything for an explanation.

That changes how you should plan. An employer that builds a human appeal channel may never offer you an opt-out. Every covered employer still owes you an answer about what the tool did. If you're choosing which right to spend effort on, choose access. It applies everywhere the rules apply, and it produces a document you can keep.

There's a practical difference too. Access requests must be verified. Opt-out requests may not be subject to identity verification. Access means proving you're the person who applied, so the records you keep now decide whether your request goes anywhere in January.

What an ADMT access response has to contain

A compliant response has to give you the specific purpose of the tool, enough of its logic for you to understand how your information produced an output, and the outcome. The outcome includes whether the output was the sole factor in the decision and, if it wasn't, what the other factors were. Generic descriptions like "to improve our services" are prohibited.

Here are the elements to hold the employer to:

1. Purpose. Not "talent acquisition." The specific use, such as ranking applicants for a particular requisition before recruiter review.
2. Logic. Enough to understand how your information produced your output. Which inputs counted: skills, titles, tenure, location?
3. Outcome. What the tool produced for you, and how the employer used it.
4. Sole factor or not. If a human or other criteria were involved, the response has to name those other factors.

Expect resistance on two points. First, the trade-secret carve-out in §7222(c) applies to the logic and outcome elements only. Employers can't use it to withhold the purpose, but they will use it to narrow how much of the scoring logic and outcome you see. Second, if the tool ran on you more than four times within 12 months, the business may give you aggregate-level logic and output summaries instead of an answer about one decision.

That second rule hits active job seekers hardest. Apply to several roles at the same company in a year and you can lose a decision-specific answer. The fix is in the wording (covered below): tie every request to one requisition ID and one date.

What the Eightfold lawsuit shows about hidden scores

Kistler v. Eightfold is a federal lawsuit alleging that Eightfold's 0-to-5 "Match Scores" are consumer reports that applicants never saw and couldn't dispute. It shows what candidates are up against when they can't see what a tool said about them, and why plaintiffs have to go through a credit-reporting law to get into court at all.

The facts as they stand:

• Case: No. 4:26-cv-01768-YGR, Northern District of California, before Judge Yvonne Gonzalez Rogers.
• Plaintiffs: Erin Kistler and Sruti Bhaumik.
• Claim: Match Scores, which the complaint says range from 0 to 5 in 0.5 increments, are consumer reports under the federal Fair Credit Reporting Act (FCRA) and California's ICRAA. FCRA carries disclosure, authorization, accuracy and dispute requirements.
• Defense: Eightfold denies it is a consumer reporting agency and describes the Match Score as an advisory productivity signal. It points to a Morgan Stanley audit of 956,931 applications that found no disparate impact. Spokesperson Kurt Foeller has been quoted by Reuters.
• Status: Eightfold's motion to dismiss is fully briefed and waiting on a ruling. Secondary sources disagree on whether the August 4, 2026 hearing went ahead, but they agree no decision has been issued.

The plaintiffs went with FCRA for a structural reason. Colorado's law has no private right of action, and CCPA ADMT enforcement belongs to regulators. FCRA lets individuals sue, and it comes with a dispute right. If Kistler survives dismissal, a hiring score could become something you can dispute, not just request. Until then, the CCPA access right is how you find out whether a score exists in your file. Request the record instead of guessing.

Which vendor scored you? Even recruiters rarely say

Most candidates can't tell which tool screened them, so ask the employer to name it. In Refolk's index of professional profiles, very few people list these tools at all, including the recruiters who run them.

Skill tags show who lists a tool on their profile, not how many employers use it, and the governance count matches titles literally, so it probably misses people doing that work under other titles. Even with those caveats, the pattern holds. The top titles among the 273 people who list Eightfold are talent-acquisition and recruiting-ops roles, and no single employer shows up more than twice. You can't work out an employer's screening stack by looking up its recruiters.

"Our vendor holds that data" isn't a valid answer either. Under §7222(i), a service provider or contractor must help the business respond to a verifiable access request. The employer owns the response, and the vendor has to help produce it.

When to send it, and how long they have

Send the request after a rejection on a decision dated January 1, 2027 or later. The employer then has 10 business days to confirm receipt and 45 calendar days to respond, with extensions capped at 90 calendar days total.

A missing notice is evidence in itself. If you're rejected in January and no access-right notice arrives within 15 business days, write that down with dates. You can't sue over it, but it's the kind of record that makes a report to CalPrivacy specific instead of anecdotal.

Timing matters even more in Colorado. Its law applies to consequential decisions made on or after January 1, 2027, so a December 2026 rejection is probably outside it. If you're mid-process in December, an offer or rejection that slips into January may land under the new rules.

How to request AI screening data from an employer

The request that gets a real answer names one decision, cites the regulation, lists each required element, and asks the employer to name the tool. This template covers all four. Adapt it, and keep it short.

Subject: CCPA request to access ADMT information, Requisition [ID], application dated [date]

I am a California resident who applied for [job title], requisition [ID], on [date], using the email address [address]. I received a rejection on [date].

Under §7222 of the CCPA regulations governing automated decisionmaking technology, I request the following for this application and decision only:

1. The name of any automated decisionmaking tool used to evaluate my application, and the vendor that provides it.
2. The specific purpose for which it was used in this requisition.
3. The logic used, sufficient for me to understand how my personal information produced its output.
4. The output the tool produced about me (for example, any score, rank, or tier).
5. Whether that output was the sole factor in the decision, and if not, what the other factors were.

Please confirm receipt within 10 business days. I understand §7222(i) requires your service providers to assist with this response. I can verify my identity using the application email and requisition details above.

Why each line is there:

• "This application and decision only" guards against the more-than-four-times rule, so you get a decision-specific answer instead of an aggregate summary.
• Naming the tool and vendor covers the gap the skill-tag data shows: you probably don't know who scored you.
• Asking for the output itself puts the score on record if one exists. That's the record Kistler suggests candidates never see.
• The verification line answers the verification requirement before they can stall on it.

None of this is legal advice. It's the regulation's own required elements, put in order.

When the answer arrives, you'll need your own read on the role to judge it. Refolk scores your fit against the posting when it tailors your resume, so if the employer's explanation says you lacked a skill your resume clearly showed, you'll see the mismatch right away.

The records to start keeping now

Keep the identifiers that tie you to each specific decision, starting with the applications you send now. Access requests must be verified, and the request is only as good as your proof of which application you mean.

For every application, save:

• The exact email address you applied with. Employers will verify against it.
• The requisition ID and the posting text. Postings disappear when roles close.
• The application date and rejection date, plus a screenshot of the rejection.
• The exact resume version you submitted. If the tool parsed and scored it, that file is the input you're asking about.
• Whether an ADMT notice appeared during the application, and whether an access-right notice followed a rejection within 15 business days.

Colorado employers have to keep relevant records for at least three years, but don't rely on their files. Keep your own.

The resume version is the item people lose most often, especially if they tailor for every posting. Refolk tailors your resume to each posting you paste into it, so each version starts out tied to the specific job. Save each one with the requisition ID in the filename. Then when an employer's response says the tool weighted your listed skills, you can check that claim against the file it actually read.

FAQ

Does the CCPA ADMT rule let me opt out of AI resume screening in California?

Often, but not always. Covered employers have to offer an opt-out unless an exception applies, such as a human appeal process. The access right has no equivalent exception, so you can ask for an explanation even where you can't opt out.

Which employers have to answer an ADMT access request?

For-profit businesses that do business in California and have more than $25 million in annual gross revenue, a threshold DataGrail currently puts at about $26.6 million. Smaller startups aren't covered. Tools already in use are covered, so a long-running screening system doesn't get a pass.

Can I sue an employer that ignores my access request?

Not under the CCPA's ADMT rules. Enforcement belongs to CalPrivacy and the Attorney General, and Colorado's law has no private right of action either. That's why Kistler v. Eightfold was brought under FCRA, which does let individuals sue. Document missed deadlines and missing notices so anything you bring to the regulator is specific.

Will I see my actual score?

You're entitled to the outcome and to whether it was the sole factor. Employers can invoke the §7222(c) trade-secret carve-out to limit detail on the logic and outcome elements, so expect some redaction. Ask for the output explicitly and tie your request to a single requisition so the answer is about your decision, not an aggregate.