Articles

September 29, 2025

California Privacy Protection Agency Heralds a "New Era of Privacy Enforcement"

Julia K. Whitelock and Eric D. Mulligan

Highlights:

  • The agency has hundreds of open investigations, many more than it has announced publicly.
  • The agency has finalized draft rules regarding the Delete Request and Opt-Out Platform, which data brokers will use to comply with statutory obligations under the Delete Act.
  • Fees for data broker registration will drop slightly in 2026.

Meeting Summary:

On September 26, 2025, the California Privacy Protection Agency Board held its bi-monthly public meeting, which provided insight into the CPPA's enforcement and rulemaking activities and priorities.

On the enforcement front, Michael Macko, the CPPA's deputy director of enforcement, announced that the CPPA has hundreds of open investigations, most of which have not yet been made public or even known to the targeted businesses. Macko claimed that consumer complaints to the CPPA have increased over time, to a current rate of about 150 complaints per week. Between July 6, 2023, and September 8, 2025, the CPPA received more than 8,000 consumer complaints. According to Macko, the CPPA has also opened investigations based on press reports and information from other regulators. The CPPA hopes to develop precedent under California privacy law through these investigations and the enforcement actions that may follow. Macko stated that the CPPA sometimes does not institute an enforcement action until years after it opens an investigation. According to Macko, the CPPA anticipates an increasing level of coordination with other states. For example, the CPPA recently announced a multistate enforcement sweep of Global Privacy Control noncompliance.

Regarding rulemaking, CPPA Executive Director Tom Kemp reported that the agency had finalized draft rules to implement the Delete Request and Opt-Out Platform (DROP). The draft rules state the procedures that a data broker must follow when complying with its statutory obligations under the Delete Act. The draft rules have been submitted to the California Office of Administrative Law for final approval. The CPPA expects that a beta version of DROP's accessible data-deletion mechanism will be available in October.

The CPPA's Board announced other developments as well. The CPPA plans to reduce the annual data broker registration fee from $6,600 in 2025 to $6,000 in 2026. The agency is developing a business education program regarding recently finalized rules on subjects such as automated decision-making technology and cybersecurity audits. These rules will take effect on January 1, 2026. The CPPA is also working with the California Department of Finance to increase the agency's 2026-27 budget.

Resources:

More information on the September Board meeting and other CPPA meetings is available on the CPPA's Board Meetings Page.

Hudson Cook, LLP provides articles, webinars and other content on its website from time to time provided both by attorneys with Hudson Cook, LLP, and by other outside authors, for information purposes only. Hudson Cook, LLP does not warrant the accuracy or completeness of the content, and has no duty to correct or update information contained on its website. The views and opinions contained in the content provided on the Hudson Cook, LLP website do not constitute the views and opinion of the firm. Such content does not constitute legal advice from such authors or from Hudson Cook, LLP. For legal advice on a matter, one should seek the advice of counsel.