Privacy professionals begin the new year considering significant changes to some state privacy requirements. Lawyers suggested resolutions to review data and get an early start on risk assessments.
California Privacy Protection Agency (CalPrivacy)
The California Privacy Protection Agency (CalPrivacy) enforces California’s privacy laws and is setting the pace for state-level regulation as one of the first U.S. privacy regulators. Also known as the CPPA, the agency regularly issues detailed rulemaking on topics such automated decision-making, audits and risk assessments, with businesses watching closely due to CalPrivacy enforcement and interpretation's outsized impact on national privacy expectations. This page tracks agency actions, final and draft regulations and compliance takeaways from CalPrivacy activity.
Many states that have had leading roles in the privacy space will continue to do so in 2026, but several newcomers will be noteworthy owing to laws coming online, potential enforcement and litigation, privacy lawyers said.
Recent amendments to the California Consumer Privacy Act and the California Privacy Protection Agency’s ongoing rulemaking efforts mark a shift toward “stronger enforcement and broader data-security obligations,” attorneys from Ervin Cohen & Jessup said in a post Friday.
Enforcement has focused heavily in 2025 on surface-level, obvious and quick fixes, privacy lawyers said in recent interviews. While this trend will continue in 2026, additional tools and other factors should keep enforcement an area to watch, they said.
Data brokers must register quickly and comprehensively in California, the California Privacy Protection Agency said in an enforcement advisory Wednesday. CalPrivacy issued the advisory, which addresses data broker registration requirements related to trade names, websites and parent-subsidiary relationships, with about two weeks to go until the planned Jan. 1 launch of the Delete Request and Opt-Out Platform (DROP).
President Donald Trump’s AI executive order late Thursday drew backlash from Democrats and Republicans -- as well as applause from tech industry groups and Capitol Hill advocates trying to avoid a patchwork of state AI regulations.
As lawsuits over tracking technologies increase rapidly, some courts have managed to narrow the scope of older statutes, countering the litigation wave, said panelists during an Interactive Advertising Bureau (IAB) webinar Wednesday. But other courts remain split on the reach of these laws, they added.
California Privacy Protection Agency (CalPrivacy) fines for Delete Act violations next fall could rise from tens of thousands of dollars to tens of millions of dollars -- at least -- with no room for negotiation on total penalties, panelists said on a webinar by consumer privacy vendor Reklaim on Wednesday. In addition, many more companies may be considered data brokers covered by the law than realize it now, they said.
Privacy Daily is providing readers with the top stories from last week, in case you missed them. All articles can be found by searching the title or clicking on the hyperlinked reference number.
The White House this week will issue an executive order blocking state AI regulation through national standards, President Donald Trump said Monday in a post on Truth Social.