Privacy regulation in California: the Privacy Protection Agency and the Attorney General.
Agency decisions shape how policy works in practice. Explore the institutions and policy matters relevant to privacy organizations, then discuss the proceedings affecting your business.
Who writes and enforces the rules.
- California Privacy Protection Agency (CPPA)CCPA and CPRA rulemaking and enforcement, including the Delete Act and the data broker registry.
- Attorney GeneralCCPA enforcement, SB 976 age-assurance rulemaking, consumer protection.
- Federal courtsDecide which of these statutes can be enforced.
Rulemakings, programs, and enforcement in 2026.
- CPPA regulationsRulemakingAutomated decision-making, risk assessment, and cybersecurity audit rules. Effective January 1, 2026; phased audit deadlines through April 2029. In effect, phasing in.
- Delete ActProgramConsumer deletion platform for data brokers. Platform live since January 1, 2026; broker compliance mandatory from August 1, 2026; $200 per request per day penalty. First fine issued August 11, 2026.
- EnforcementEnforcement2026 CCPA and Delete Act actions. General Motors $12.75 million (May 2026), Disney $2.75 million (February 2026), PlayOn Sports $1.1 million (March 2026), first Delete Act fine against a data broker (August 2026). Posture is live.
Discuss your California
policy priorities.
Tell us what is changing for your organization.
We’ll discuss the representation and scope you need.