The California Privacy Protection Agency implements two laws the California Consumer Privacy Act (2018, 2020) and the Delete Act (2023).
In November 2020, California voters passed Proposition 24, the California Privacy Rights Act ("CPRA"). The CPRA amends and extends the California Consumer Privacy Act of 2018 ("CCPA"). To implement the law, the CPRA established the California Privacy Protection Agency ("Agency") and vested it with the full administrative power, authority and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.
On October 10, 2023, the Governor signed Senate Bill 362 into law. The law tasks the Agency with establishing a deletion mechanism that allows consumers to request from all data brokers the deletion of all non–exempt personal information related to the consumer through a single deletion request to the Agency.
The law also transferred the administration and enforcement of the Data Broker Registry from the Office of the Attorney General to the California Privacy Protection Agency (“Agency”) as of January 1, 2024. The Agency now maintains the Data Broker Registry and posts publicly the required information disclosed by data brokers. The Agency is authorized to promulgate rules to implement the Act.
Information regarding the rulemaking process will be posted to this page. If you would like to receive notifications regarding rulemaking activities, please subscribe to our email list here.