At a Glance
- The CPPA is California’s dedicated privacy regulator, created to enforce and shape state privacy laws independently of the Attorney General.
- Its authority goes beyond enforcement and includes rulemaking, audits, public education, and oversight of the Delete Act and data broker registry.
- The agency is actively targeting issues like dark patterns, ineffective opt-outs, and excessive data collection across businesses of all sizes.
- CPPA penalties can be significant, and recent enforcement actions show that noncompliance carries real financial risk.
- Staying compliant requires operational privacy controls, including clear consent flows and systems that can stand up to audits and regulatory scrutiny.
The California Privacy Protection Agency (CPPA), now publicly known as CalPrivacy, is the first dedicated privacy regulator in the United States. The Agency was created to enforce and evolve California’s data protection laws, namely the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA).
The Agency plays a central role in shaping how businesses collect, use, and protect the personal data of California consumers. It fines businesses for violations of California privacy laws; develops rules around areas like consent, data minimization, and automated decision-making; and works with other state regulators on enforcement activities.
This guide breaks down what the CPPA is, how its authority works, where it’s focusing enforcement, and what businesses need to do to keep data operations privacy-compliant.
What Is the California Privacy Protection Agency (CPPA)?
The CPPA/CalPrivacy is an independent agency created by the California Privacy Rights Act (CPRA) to implement and enforce California privacy laws.
It’s the first independent privacy agency established in the United States, and its mission is to protect the privacy rights of California consumers. It does this in a few different ways:
Rulemaking: Adopting and updating regulations to implement privacy laws and address changes in technology and data practices
Enforcement: Investigating possible violations (either proactively or responding to complaints) and bringing administrative enforcement actions against businesses, service providers, or contractors that fail to comply
Auditing: Conducting audits of businesses to ensure compliance with privacy standards
Public education: Informing consumers about their rights and providing guidance to businesses to help them understand their legal obligations
Policy advice: Providing technical assistance and advice to the California Legislature on privacy-related legislation
The agency has full administrative power, authority, and jurisdiction to implement and enforce the CCPA/CPRA, as well as the Delete Act.
Why Was the CPPA Created?
CalPrivacy was created in 2020 through the passage of Proposition 24, also known as the CPRA.
The goal was to establish an independent watchdog with the sole mission of protecting consumer privacy instead of relying only on the Attorney General for enforcement of California privacy laws.
The agency emerged as a solution to inform businesses and consumers of their rights and enforce the law against those who violate privacy rights.
The CPPA was also created in part to update regulations in the face of rapid changes in technology and data collection practices.
What Authority Does CalPrivacy Have?
CalPrivacy’s authority spans rulemaking, investigation, audit, and enforcement across the CCPA and the CPRA.
Rulemaking Authority
CalPrivacy has the authority to adopt, amend, and rescind regulations to carry out the provisions of the CCPA. This includes creating rules for emerging concerns like automated decision-making technology (ADMT), cybersecurity audits, risk assessments, and sensitive categories like neural data.
Administrative Enforcement
The Agency protects consumer privacy through the following actions:
Investigations: It can investigate potential violations of the law, either on its own initiative or based on sworn complaints from the public.
Probable cause proceedings: If evidence supports a reasonable belief that California privacy law has been violated, the Agency can hold hearings to determine if an infraction occurred.
Administrative fines: CalPrivacy can issue orders requiring violators to cease and desist and pay administrative penalties.
Subpoena power: The Agency can subpoena witnesses, take evidence, and request any relevant records.
Auditing Power
The Agency has the authority to conduct audits of businesses, service providers, or contractors to ensure compliance with the CCPA/CPRA. It’s responsible for appointing a Chief Privacy Auditor and building out an audits department to lead these efforts. Audits may be announced or unannounced, and failure to cooperate can result in the issuance of subpoenas or warrants.
Public Education and Policy Advice
CalPrivacy is tasked with increasing public awareness of privacy risks and rights. It also provides technical assistance and advice to the California Legislature on privacy-related legislation and can sponsor its own bills, such as the California Opt Me Out Act.
Cooperation with Other Regulators
The CPPA has the authority to cooperate with other jurisdictions, including other states and international data protection authorities, to ensure the consistent application of privacy protections. It helped establish the Consortium of Privacy Regulators in 2025 to collaborate with various state Attorneys General on enforcement.
Authority Under the Delete Act
With authority from the 2023 Delete Act, CalPrivacy oversees:
- Data Broker Registry: It maintains and enforces the registration of data brokers in California.
- DROP (Delete Request and Opt-out Platform): It’s tasked with maintaining a “one-stop shop” platform that enables consumers to request data deletion from all registered data brokers in a single step.
What Do CPPA Fines and Penalties Look Like?
CalPrivacy, alongside the California Attorney General, has the authority to impose significant financial penalties on businesses that violate privacy laws.
Violations are penalized based on the nature of the infraction, and penalties are adjusted periodically to align with the Consumer Price Index:
- Up to $2,500 per violation for unintentional violations of the law
- Up to $7,500 per violation for intentional violations or any violations involving the personal information of consumers known to be under 16 years of age
And the agency doesn’t hesitate to enforce its authority when required. According to the CalPrivacy 2025 Annual Report, CPPA enforcement actions have covered a wide range of industries.
Some recent significant fines from enforcement actions include:
- USD 1.35 million to Tractor Supply Companyfor failing to maintain an adequate privacy policy, failing to notify job applicants of privacy rights, failing to provide an effective opt-out mechanism, and disclosing personal information (PI) without privacy protective contracts
- USD 632,000 to American Honda Motor Co.for requiring Californians provide verification or excessive PI to exercise certain privacy rights, using dark patterns that made it hard for consumers to use authorized agents, and sharing PI with ad tech companies without privacy protective contracts
Note that the CPPA doesn’t just target large corporations; it also audits and fines smaller companies for minor infractions. Businesses are not immune from enforcement action just because they’re smaller, especially given that automated technologies are in use to audit websites for data handling practices.
CPPA Enforcement Priorities Businesses Need to Know
CalPrivacy has established several clear enforcement priorities that businesses should pay special attention to. These priorities are informed by recurring complaints, periodic investigative sweeps, and the agency’s overarching goal of protecting consumers.
The agency has publicly emphasized areas like dark patterns, honoring opt-outs, data minimization, and transparency. Here’s what you need to know to achieve and maintain privacy compliance in California.
Dark Patterns and Consent Manipulation
The agency closely scrutinizes interfaces that use dark patterns to steer user privacy choices.
Examples of this include asymmetrical choices, such as making an “Accept” button more prominent or hiding the “Decline” option, or using double negatives, like a “Yes/No” toggle next to a “Do Not Sell or Share My Personal Information” label.
Consent manipulation also includes disruptive choice architecture, such as forcing consumers to click through multiple screens or scroll through a full privacy policy just to find an opt-out link.
Part of the justification for the USD 632,000 fine on Honda was the use of dark patterns to present privacy choices in an asymmetrical or unequal way.
To avoid penalties for dark patterns, take the following measures:
Ensure that the path to exercise a privacy-protective option is not longer or more difficult than the path to a less protective one.
Understand that consent must be freely given, specific, informed, and unambiguous: hovering over content, muting it, or closing a pop-up without choosing doesn’t constitute valid consent.
Use straightforward language, avoid technical jargon, and provide equal prominence to “Accept” and “Decline” options.
Opt-Outs and Universal Consent
Consumers have the right to request that a business stop selling or sharing their personal information, and CalPrivacy places special emphasis on this right.
The USD 1.35 million penalty against Tractor Supply cited a failure to provide an effective opt-out mechanism as one justification for the violation.
A key component is Opt-out Preference Signals (OOPS), such as Global Privacy Control (GPC), which enable consumers to automatically signal their opt-out choice to every website they visit via their browser settings. By January 1, 2027, all browsers in California will be required to offer a built-in OOPS feature.
To respect opt-outs and universal consent:
Honor OOPS as a valid consumer request to stop selling or sharing data.
If you sell or share data, provide a “Do Not Sell or Share My Personal Information” link or a single “Your Privacy Choices” link accompanied by a mandatory opt-out icon.
Respond to opt-out requests within 15 business days.
Data Minimization
CalPrivacy aims to confirm that a business’s collection, use, and retention of personal information is reasonably necessary and proportionate to achieve the purpose for which it was collected. This means you should only collect the minimum amount of information necessary for a specific, disclosed purpose.
For example, an alarm clock app shouldn’t collect a user’s precise geolocation, because it’s not necessary for the app’s functionality. Or for an email newsletter signup, you don’t need the subscriber’s date of birth or home address.
This principle also applies to how businesses handle data subject requests and how much information they ask for when processing them. Clothing retailer Todd Snyder, for example, was fined USD 345,178, in part for requiring consumers to submit more personal information than necessary to process privacy requests.
Situations like this are avoidable with the right approach. Review your data practices to ensure you’re not collecting data that is unrelated to your core services. Avoid requesting additional information when verifying a consumer’s identity for a privacy request. Instead, attempt to match the consumer’s request against data already in your systems.
Transparency
In a recent report, the agency cites review of privacy notices and privacy policies as one of its enforcement priorities which puts transparency at the forefront of CPPA scrutiny. In fact, failing to maintain an adequate privacy policy was one of the reasons noted for the seven figure fine on Tractor Supply Company.
Create a customized privacy policy for your website in minutes, for free: Usercentrics Privacy Policy Generator
This focus on transparency extends to the data broker industry, where the agency has stepped up enforcement through its new Data Broker Enforcement Strike Force. The initiative actively pursues data brokers that fail to meet transparency requirements under the Delete Act.
This regulation requires data brokers to register annually with the agency and gives consumers more visibility into the multi-billion dollar industry that collects and sells their personal information. In 2024 alone, the agency recovered over USD 170,000 in administrative fines from data broker non-compliance settlements.
To increase transparency with consumers and protect your business, you should:
Make notices easy to read, available in the primary languages of your customers, and accessible to individuals of all abilities.
Clearly state whether personal information — including sensitive personal information such as neural data — is sold or shared.
Make your privacy policy conspicuous and easily accessible on your website (typically located in the footer).
Avoid CPPA Scrutiny and Enforcement With Usercentrics
As CCPA enforcement accelerates and CalPrivacy continues to crack down, compliance requires more than surface-level fixes.
You need a tool that operates as your core infrastructure and operationalizes privacy across every touchpoint. That’s where Usercentrics can help.
Usercentrics Consent Management Platform applies geolocation-based rules, enables granular consent management, and recognizes opt-out signals like GPC automatically. It also comes with integrations for Google Consent Mode, Microsoft UET Consent Mode, and Amazon Consent Signal out of the box, so you can make sure opt-out signals are respected throughout your marketing stack.
Usercentrics CMP includes prior blocking where required, and tag control to prevent unlawful data collection. It provides secure consent record storage for accountability and audit-readiness.
Instead of reacting to evolving California privacy laws, Usercentrics helps businesses automate and scale privacy practices to align with CPPA priorities.
Join our growing community of data privacy enthusiasts now. Subscribe to the Usercentrics newsletter and get the latest updates right in your inbox.
