On February 28, 2025, the California Privacy Protection Agency (CPPA) published its annual report for 2024. The CPPA was very active last year, and we expect to see even more activity this year. Below are our biggest takeaways from the annual report.
Enforcement of the Delete Act
California’s Delete Act, which went into effect on January 1, 2024, provides California consumers the right to request that data brokers delete their personal information. Pursuant to the Delete Act, the CPPA launched a Data Broker Registry, which processed the registration of 543 data brokers in 2024. The CPPA plans to launch a first-of-its-kind deletion mechanism allowing consumers to request the deletion of their data across all registered brokers, known as the Delete Request and Opt-out Platform (DROP). Registered data brokers will use the platform to retrieve deletion requests at least every 45 days.
In December 2024, the Data Broker Registration regulations took effect. The regulations clarify and expand existing registration requirements for data brokers and establish the 2025 registration fee to fund the data broker registration and DROP system.
CPPA enforcement priorities and sweeps
The CPPA’s Enforcement Division focuses on conducting investigations and stopping the improper use of personal information by businesses subject to California privacy laws. Based on the 2024 report, the Enforcement Division has the following enforcement priorities:
- Review of privacy notices and privacy policies
- Implementation of consumer requests
- The right to delete
- Selling or sharing personal information without proper notice or an opt-out mechanism
- Dark patterns/deceptive design
- Violations that affect vulnerable communities and groups
The Enforcement Division conducts periodic investigative sweeps to …
California delays CPRA regulations
The California Privacy Protection Agency (CPPA) was supposed to finalize new pri…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
