Laws and regulations

In November 2020, California voters passed Proposition 24, which amended the California Consumer Privacy Act of 2018 (“CCPA”) and established the California Privacy Protection Agency (“CalPrivacy”). CalPrivacy is responsible for implementing and enforcing the CCPA as well as the Delete Act, which creates additional requirements unique to data brokers. To fulfill its duties, CalPrivacy is authorized to adopt and amend regulations through the Administrative Procedures Act rulemaking process under both laws.

Below are topics that CalPrivacy is exploring to determine whether regulatory changes are necessary. The Agency is gathering information and seeking input from stakeholders about these topics. Proposals appearing below have not yet advanced to formal rulemaking.

• Delete Request and Opt-out Platform (DROP) Audits – The preliminary comment period closed on May 7, 2026.
• Employee Data –The preliminary comment period closed on May 20, 2026.
• Notices & Disclosures –The preliminary comment period closed on May 20, 2026.
• Reducing Friction in the Exercise of Privacy Rights – Thepreliminary comment period closed on April 6, 2026.
• Opt-out Preference Signals (OOPS) – The preliminary comment period closed on April 6, 2026.

Proposed regulations are draft regulations proposed by the Agency that are currently in the formal rulemaking process but have not yet been adopted and are therefore not in effect. The Agency does not have any proposed regulation packages at this time.

Below are the rulemaking documents for regulations the Agency has already adopted.

• Data Broker Registration Fee Regulations (December 2025)
• Accessible Deletion Mechanism – Delete Request and Opt-out Platform (“DROP”) System Requirements (November 2025)
• CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments, and Automated Decisionmaking Technology (ADMT) Regulations (September 2025)
• Data Broker Registration Fee Regulations (December 2024)
• Data Broker Registration Regulations (December 2024)
• Data Broker Registration Fee Regulations (January 2024)
• California Consumer Privacy Act Regulations (March 2023)
• Transfer of Rulemaking Authority & New Division for CPPA Regulations (April 2022)
• Conflict of Interest Code Regulation (February 2022)

If you would like to receive notifications regarding rulemaking activities, please subscribe to our email list. You can also view tips for submitting effective public comment during formal rulemaking.