California Privacy Protection Agency

What California Privacy Protection Agency does

The California Privacy Protection Agency (CPPA) is a California state government regulatory agency established in 2020 by Proposition 24 (the California Privacy Rights Act) to implement and enforce the California Consumer Privacy Act (CCPA), as amended by CPRA. The agency is governed by a five-member board, headquartered at 400 R Street Suite 350, Sacramento, CA 95811, and operates with approximately 33 employees. Its mandate covers rulemaking, public education on privacy rights and business responsibilities, complaint processing, and enforcement actions against businesses, service providers, contractors, and third parties alleged to violate the CCPA. As the sole state agency with this statutory mandate, CPPA coordinates with the California Office of the Attorney General, which retains certain consumer-complaint functions.

CPPA's core products and technology infrastructure center on two interconnected platforms: the Delete Request and Opt-Out Platform (DROP), a centralized web application that allows California consumers, through a single verifiable request, to direct every registered data broker to delete their personal information (with brokers required to access DROP at least once every 45 days starting August 1, 2026, via manual download or API); and the Data Broker Registry, a public registry listing all data brokers doing business in California along with business details, data collection practices, and consumer request metrics. Supporting products include CCPA regulations and guidance, a consumer complaint system, the $6,000 annual data broker registration system, mailing list subscriptions, and consumer-facing educational resources on the six core privacy rights (Limit, Opt-Out, Correct, Know, Equal Treatment, Delete). The agency's revenue model is regulatory rather than commercial: funding derives from California state appropriations plus annual data broker registration fees of $6,000 plus third-party processing fees. With 500+ registered data brokers, fee-derived funding alone implies approximately $3M+ annually. Its distribution is government-style and direct-to-public: cppa.ca.gov website, email mailing lists, public board meetings under the Bagley-Keene Open Meeting Act, pre-rulemaking stakeholder sessions, and informational sessions. Geographic scope is limited to California residents and California-doing-business entities.

Name

California Privacy Protection Agency

Legal name

California Privacy Protection Agency

Website

https://cppa.ca.gov

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

The California Privacy Protection Agency is a California state government regulatory agency that implements and enforces the California Consumer Privacy Act. It operates the DROP platform and Data Broker Registry to protect consumer privacy rights for California residents.

Ownership category

akta.pro rank

Product category

Government Privacy Regulation

NAICS

Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (92615)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industry

Privacy Governance & Consent Management (HDADAIAI)

Keywords

• Consumer privacy rights
• Data broker registry
• Privacy regulatory enforcement
• Personal data protection
• Privacy law compliance

Headquarters

HQ city

Sacramento

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Infrastructure, Marketing or Sales

Revenue model

1. Data Broker Registration Fees: Annual registration fees collected from data brokers required to register with the agency. The registration fee is $6,000 plus an associated third-party processing fee for electronic payments. This is a regulatory fee mechanism rather than commercial revenue.

Pricing tiers

Go-to-market motion1 record

Distribution channels4 records

Marketing channels5 records

Core offering

The California Privacy Protection Agency is a California state government agency that implements and enforces the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). It operates the Delete Request and Opt-Out Platform (DROP) for centralized consumer deletion requests to data brokers, administers the public Data Broker Registry, processes consumer complaints, conducts rulemaking, and brings enforcement actions against violators. The agency's primary "product" is regulatory oversight, with annual data broker registration fees of $6,000 plus processing fees as its only fee-based mechanism.

Product overview

The California Privacy Protection Agency (CPPA) is a government regulatory agency overseeing the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). Rather than a commercial software product, CPPA provides a suite of regulatory platforms and programs including the Delete Request and Opt-Out Platform (DROP) for centralized consumer deletion requests to data brokers, the Data Broker Registry for public transparency, CCPA Regulations implementation, a Consumer Complaint System for enforcement, and the Data Broker Registration System for annual compliance. These interconnected programs work together to protect California residents' privacy rights and enforce business compliance obligations under California privacy law.

Differentiator

Problem solved

Functional benefit

Brands

• DROP (Delete Request and Opt-out Platform): A website application created by the Agency that allows consumers, through a single verifiable request, to direct every data broker to delete their personal information.
• CalPrivacy

Products and services

• Delete Request and Opt-Out Platform (DROP) A centralized web application that allows California consumers to submit a single verifiable deletion request that is propagated to all registered data brokers, and enables data brokers to download and process consumer deletion lists either manually or via API access (every 45 days starting August 1, 2026).
• Data Broker Registry A public registry maintained by CPPA listing all registered data brokers doing business in California, including their business details, data collection practices (e.g., reproductive health care data, precise geolocation, minors' data), consumer request metrics, and compliance information.
• Data Broker Registration System An annual registration system that requires data brokers to register with CPPA between January 1-31 each year, pay a $6,000 annual registration fee plus third-party processing fees, and disclose required information about their data collection, selling/sharing practices, and consumer request handling.
• Consumer Complaint System A web-based system that allows California consumers to file complaints (both sworn and unsworn) against businesses, service providers, contractors, or third parties alleged to have violated the CCPA.

Quantifiable outcome

• CCPA regulations became effective March 29, 2023
• +2 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration3 records

Feature2 records

Partnerships

One partnership is on record.

• Office of the Attorney General (California)coreOthers · 1 January 2020The Office of the Attorney General previously administered the Data Broker Registry. As of January 1, 2024, administration and enforcement of the Data Broker Registry was transferred from the Office of the Attorney General to the California Privacy Protection Agency. The Attorney General continues to handle certain consumer complaints.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Others

• OneTrust: OneTrust is a leading privacy management software platform used by businesses to operationalize CCPA/CPRA compliance, consent, DSAR, and RoPA. Thematically connected to CPPA: OneTrust's product roadmap is shaped by CPPA's regulations, and the platform is the primary tooling used by regulated entities to comply with the agency's rules.
• International Association of Privacy Professionals (IAPP): IAPP is the largest global information privacy community and certifying body for privacy professionals. Connected to CPPA as a thematic ecosystem participant — the same regulated community, regulated entities, and professionals that CPPA engages with through rulemaking and enforcement interact with IAPP for training and certification.

Direct peers

• Colorado Department of Law — Privacy Division: Colorado's Privacy Division administers the Colorado Privacy Act (CPA), performing rulemaking and enforcement of a comprehensive state privacy regime. Directly comparable to CPPA in scope and structure: state-level dedicated privacy regulator with rulemaking and enforcement authority.
• Connecticut Department of Consumer Protection: Connecticut's privacy enforcement (including under the Connecticut Data Privacy Act) sits alongside consumer protection authority. Comparable to CPPA as a state-level body implementing a comprehensive consumer privacy statute with enforcement powers.
• New York Office of the Attorney General (Consumer Protection): The New York AG's Consumer Protection Bureau enforces the New York SHIELD Act and other state privacy and data-security laws. Comparable to CPPA because it is a state-level authority using rulemaking guidance, civil investigations, and enforcement actions to protect consumer data rights.

Broad incumbents

• Commission Nationale de l'Informatique et des Libertés (CNIL): CNIL is France's national data protection authority enforcing the GDPR-equivalent regime, with rulemaking, guidance, and enforcement powers. Comparable to CPPA as a dedicated privacy regulator, though operating at national scope with a mature enforcement apparatus and larger regulatory team.
• Office of the Privacy Commissioner of Canada: Canada's federal privacy regulator under PIPEDA and the Privacy Act. Comparable to CPPA because it is a national-level dedicated privacy authority with rulemaking, complaint handling, and audit/enforcement functions.
• Consumer Financial Protection Bureau (CFPB): CFPB is an independent federal agency enforcing consumer financial protection laws via rulemaking, supervision, and enforcement. Comparable to CPPA structurally as an independent regulator with a board, dedicated consumer-protection mandate, and rulemaking authority, though focused on financial services rather than privacy per se.
• Federal Trade Commission (FTC): The FTC is the federal consumer-protection and privacy enforcement agency (including Section 5 and the FTC Privacy Act). It is the closest analog to CPPA at the federal level, with broader jurisdiction across all states and overlapping authority over unfair or deceptive privacy practices. Comparable to CPPA because both enforce consumer privacy through rulemaking, investigations, and civil penalties.

Regional players

• Texas Office of the Attorney General — Consumer Protection Division: Texas AG's Consumer Protection Division enforces the Texas Data Privacy and Security Act and other privacy laws. A state-level privacy enforcer with a comparable mandate but operating in a different jurisdiction and political environment from CPPA.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/calprivacy

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about California Privacy Protection Agency