California Has Its Own Privacy Regulator. Here Is What It Does.

Most US privacy law is enforced by attorneys general as a side function. California built a dedicated agency for it — the only one of its kind in the country — and it has rulemaking power, not just enforcement power.

What the CPPA is

The California Privacy Protection Agency is a state agency dedicated to consumer privacy. It enforces California privacy law, conducts rulemaking, operates the Data Broker Registry, and accepts consumer complaints through a formal process.

Rulemaking is the part that matters

An enforcement-only body reacts to violations of rules someone else wrote. A regulator with rulemaking authority writes the rules. That is why companies operating in California track CPPA rulemaking proceedings the way they track legislation — and why the agency invites the public to participate in them.

The Data Broker Registry

California requires data brokers to register with the agency. The registry is public, which means you can look up whether a company that holds data about you is a registered broker — a starting point most people do not know exists.

DROP: deletion across brokers at once

The agency operates DROP, the Delete Request and Opt-out Platform. The significance is scale: rather than chasing each data broker individually, the platform is designed to carry a request across registered brokers. For anyone who has tried to delete their data broker by broker, that difference is the entire point.

Complaints go to the agency

If a business ignores a privacy request, that is a complaint the CPPA accepts. You do not need a lawyer to file one, and the agency publishes its process.

Why Californians have leverage other Americans do not

The combination is unusual: a specific set of consumer privacy rights, a dedicated regulator that can write rules about them, a public registry of the companies trading personal data, and a central platform for deletion requests. Most states have none of those four.

The agency’s own pages on your privacy rights and on the laws it enforces are the authoritative place to check what you can demand and from whom.

Regulations under this agency are actively developing. Check the CPPA directly for the current rules. Verified 25 August 2026.