California Privacy Protection Agency

Rule Changes

Fined two brokers for registration failures, closed the first deletion cycle, and expects most brokers met the September 15 deadline

California's one-stop data-deletion platform, the Delete Request and Opt-Out Platform (DROP), closed its first 45-day enforcement cycle on September 15. The agency has already fined two firms that ignored the law: LocateSmarter $116,490 and Cybba $52,400.

Updated Sep 29

Rule Changes

Primary enforcer of California privacy law alongside state Attorney General

California passed the first comprehensive state privacy law in 2018. Eight years later, twenty states have followed, creating a regulatory patchwork that now covers roughly half the American population. Indiana, Kentucky, and Rhode Island's laws took effect January 1, 2026, joining a wave of amendments and enforcement actions that force every consumer-facing app to reckon with data collection practices.

Updated May 27

Rule Changes

Defending California's regulatory authority

The DOJ's AI Litigation Task Force began operations January 10, 2026 with one mission: kill state AI laws in federal court. Attorney General Pam Bondi's team, consulting with AI czar David Sacks, will challenge comprehensive AI regulations from California, Texas, and Colorado that President Trump's December executive order called unconstitutional burdens on interstate commerce.

Updated May 20