/>iBefore assuming his new role as Executive Director for the California Privacy Protection Agency (CPPA), Tom Kemp served as a volunteer policy advisor on the Delete Act in 2023 and California’s 2020 ballot initiative, which amended the California Consumer Privacy Act (CCPA). Today, as the leader of the CPPA, the only dedicated privacy enforcer in the United States, Kemp remains steadfast in its commitment to privacy rights, paying close attention to consumer and business perspectives and adopting a collaborative approach to rule-making.
In January 2023, the CPPA ceased sharing its enforcement authority with the California Department of Justice after amendments to the California Privacy Rights Act (CPRA) under the CCPA transferred administrative enforcement duties to the CPPA. Accordingly, the CPPA has invested considerable time in developing a framework that is cognizant of possible violations and familiar with consumer needs.
In 2025, the CPPA produced its first two public settlements (with Honda and Todd Snyder), signaling its readiness to address a backlog of violations and highlighting its primary focus areas. Reflecting on the CPPA’s efforts thus far, Kemp notes the important role of enforcement advisories and sweeps, which enable the CPPA to understand consumer complaints—a key aspect of the CPPA’s investigatory work and something it heavily relies upon.
According to Kemp, the CPPA will appoint a chief auditor to lead an audit division to assist and complement the enforcement division. Such efforts further support the CPPA’s efforts to provide businesses with additional resources for their compliance duties and to identify specific topics for auditing.
Approaches to Rule Making
When Kemp assumed his new leadership position at the agency, the CPPA Board was engaged in its latest rulemaking endeavors on automated decision-making technology, risk assessments, and cybersecurity audits. That pre-rulemaking process was most recently complemented in May by the launch of a public consultation of the rules’ latest iteration.
Under the Board’s direction, the CPPA wants to ensure its regulations complement and do not overlap with other regulatory regimes, prioritizing alignment goals. For instance, a standing proposal attempts to satisfy compliance requirements for a business complying with Colorado law to automatically comply with California’s proposed amendments.
The CPPA’s rulemaking capacity highlighted in the ballot initiative merely sets the standard. The CCPA’s efforts will monitor developments, track changes, and ensure that rules are properly amended or added.
Rule Making Under the Delete Act
Enacted on October 10, 2023, the Delete Act was part of California’s latest efforts to allow users to request the deletion of their personal information from data brokers by consolidating an overall process. The “Delete Request and Opt-Out Platform,” (DROP) requires businesses to stop collecting and sharing consumer personal data when requested by the consumer. The CPPA is set to launch the DROP system by January 1, 2026.
Currently, the CPPA is drafting rules for implementing the DROP system. Kemp warns businesses that, under the Delete Act, fines may be costly and might catch entities by surprise. A violation by data brokers who are required to honor opt-out requests starting August 1, 2026, results in a $200 per-incident fine.
We will continue to monitor the CPPA’s efforts and enforcement focus. As we have said, now is the time for your business to implement a consumer privacy rights compliance program or to revise your current program.
