The California Privacy Protection Agency (CPPA, sometimes styled CalPrivacy) is the state agency responsible for implementing and enforcing the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and the Delete Act. It was created in 2020 by Proposition 24. Its functions are educating the public and businesses, adopting regulations, investigating and auditing businesses and imposing administrative penalties, cooperating with other privacy enforcers, and advising the Legislature (Source: privacy.ca.gov). Its rulemaking includes the CCPA regulations covering automated decision-making technology, risk assessments, and cybersecurity audits, which regulate many AI systems through privacy law rather than as a distinct technology category.
| Established | 2020, by Proposition 24 (the California Privacy Rights Act) |
| Governance | Five-member board; chair Jennifer M. Urban (appointed March 2021) |
| Executive director | Tom Kemp |
| Laws enforced | California Consumer Privacy Act; Delete Act; Opt Me Out Act |
| Divisions named in 2026 actions | Enforcement Division; Audits Division |
Governance and leadership
The agency is governed by a five-member board. As of September 2026 the members are chair Jennifer M. Urban of UC Berkeley School of Law (appointed by Governor Gavin Newsom in March 2021); Jill Hamer (appointed by Newsom in August 2025); Drew Liebert (appointed by Senate President pro Tempore Mike McGuire in April 2024); Alastair Mactaggart, founder of Californians for Consumer Privacy and sponsor of the CCPA and Proposition 24 ballot measures; and Nicole Ozer, executive director of the Electronic Frontier Foundation (appointed by Assembly Speaker Robert Rivas in December 2025). Executive director Tom Kemp, a former technology entrepreneur, advised on the Delete Act (SB 362) and the California AI Transparency Act (SB 942). The chief privacy auditor, Sabrina Boyson Ross, previously held privacy and policy roles at Meta, Uber and Apple (Source: privacy.ca.gov). The Enforcement Division investigates potential violations, and the board reviews those actions and issues decisions (Source: privacy.ca.gov).
Rulemaking on automated decisionmaking technology
The CPPA board adopted regulations on cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies, and updates to existing CCPA rules on July 24, 2025. The Office of Administrative Law approved them on September 23, 2025, with an effective date of January 1, 2026 (Source: cppa.ca.gov; cppa.ca.gov). Compliance is phased:
| Requirement | Compliance date | Source |
|---|---|---|
| Risk assessments | Begin by January 1, 2026; documentation submitted to the agency by April 1, 2028 | (Source: whitecase.com) |
| ADMT used for significant decisions: pre-use notice, opt-out (subject to exceptions), and access rights | January 1, 2027 | (Source: cppa.ca.gov) |
| Cybersecurity audits for businesses whose processing presents "significant risk" to security | 2028–2030, phased by annual gross revenue | (Source: gtlaw.com) |
The regulations state that the goal of a risk assessment is restricting or prohibiting processing "if the risks to privacy of the consumer outweigh the benefits" (California CCPA/CPRA Regulations — Automated Decision-Making Technology (ADMT); California CCPA Regulations (Title 11, Division 6)). Florence G'sell's December 2024 Stanford Cyber Policy Center report described the regulations as then drafted: they would require businesses using ADMT to notify consumers how they intend to use it, so that consumers can opt out or seek more information, and to complete risk assessments (Regulating Under Uncertainty: Governance Options for Generative AI (G'sell, 2024)). The CPPA has also issued an enforcement advisory on dark patterns. Nita Farahany cites it in arguing that overlapping state rules have not stopped companion chatbots from using manipulative design (Inside My AI Law & Policy Class 17: Governing AI Manipulation Through Five Paradigms (Farahany, October 2025)).
Data brokers and the Delete Act
The Delete Act requires data brokers to register with the agency each January and pay a fee that funds the Data Broker Registry and the Delete Request and Opt-out Platform (DROP). DROP, launched in 2026, lets consumers direct all registered brokers to delete their personal information with a single request (Source: privacy.ca.gov). Farahany describes the mechanism as a universal opt-out that propagates one deletion request to every registered broker, with a 45-day compliance window. She notes that it does not change how data is collected in the first place (Inside My Advanced Topics Class 8.3: What the Law Is Trying to Do About It (Farahany, March 2026)).
A Stanford HAI and RegLab brief published in August 2026 studied all 522 brokers registered with the agency in 2025. It found that 45% reported no information about consumer requests received, and only 9.2% were fully compliant with reporting requirements. It also reports that the 2026 registry newly asks brokers whether they sell data to generative-AI developers, and that 32 do (Regulating Data Brokers in the Age of AI: A California Case Study).
Enforcement
As of September 2026, the board's public docket lists 22 enforcement decisions (Source: privacy.ca.gov). They include February 27, 2026 decisions against Ford Motor Company, over what the agency's announcement called unnecessary friction in its opt-out process, and against youth sports media company 2080 Media (PlayOn Sports), announced with a $1.1 million fine (Source: privacy.ca.gov; privacy.ca.gov). On August 10, 2026, the board ordered Iowa data broker LocateSmarter LLC to pay $116,490 for failing to register on time and for requiring Californians to provide the last four digits of their Social Security number before opting out. It was the agency's first action against a data broker under the CCPA and its first under both the CCPA and the Delete Act, after more than a dozen Delete Act actions. Head of enforcement Michael Macko cited the agency's work with the Attorney General and four district attorneys in a General Motors privacy investigation that produced a $12.75 million settlement (Source: privacy.ca.gov).
First sectoral audit: gig-economy platforms
On July 21, 2026, the CPPA launched its first sectoral CCPA compliance audit, targeting gig-economy platforms over the geolocation, biometric, and performance data feeding algorithmic dispatch, ratings, and pay decisions. The audit tests whether workers' access requests are fulfilled within the 45-day statutory window (Source: privacy.ca.gov; hunton.com). The agency said the audit, conducted by its newly formed Audits Division under Civil Code section 1798.199.40, is the first in a series of sectoral audits. It responds to hundreds of consumer complaints and to comments received during rulemaking. The audit covers app-based transportation, delivery and task services and examines whether responses to access requests are complete. The agency noted that, unlike other states' laws, California's privacy laws let employees and independent contractors exercise privacy rights against the businesses they work for, and stated: "You cannot contest a decision made by an algorithm without the underlying data" (Source: privacy.ca.gov).
International cooperation
The CPPA has been a voting member of the Global Privacy Assembly since 2022, alongside the Federal Trade Commission. The Center for AI and Digital Policy notes that neither US voting member has endorsed the Assembly's principal AI resolutions, including its 2023 resolution on generative AI systems (CAIDP AI & Democratic Values Index 2026).
Relationships
- related: California CCPA/CPRA Regulations — Automated Decision-Making Technology (ADMT) — the rules it enforces.
- regulated-by (inverse): gig-economy platforms; see Transportation — AI Deployment, AI Labor Disruption.
- related: State-Level AI Regulation.
- related: California Age-Appropriate Design Code Act (CAADCA, AB 2273) — enforced by the Attorney General rather than by the agency
- related: California AI Transparency Act (SB 942) — AI Transparency Act, on which its executive director advised
- related: Regulating Data Brokers in the Age of AI: A California Case Study, Inside My Advanced Topics Class 8.3: What the Law Is Trying to Do About It (Farahany, March 2026), Inside My AI Law & Policy Class 17: Governing AI Manipulation Through Five Paradigms (Farahany, October 2025), CAIDP AI & Democratic Values Index 2026, Regulating Under Uncertainty: Governance Options for Generative AI (G'sell, 2024)
- related: Federal Trade Commission (FTC) — fellow US voting member of the Global Privacy Assembly