CPPA: California Privacy Protection Agency (CalPrivacy)

The agency now brands itself CalPrivacy and moved its announcements to privacy.ca.gov in January 2026, leaving the old cppa.ca.gov site for the registry and board meetings. Its enforcement decisions are published under the heading 'Board decisions', with fine amounts only in the order PDFs; the largest so far is $1.35 million against Tractor Supply. Its 2025 regulations on risk assessments, cybersecurity audits and automated decision-making phase in from 2026 through 2030.

What CPPA publishes

• Newsroom announcements and enforcement advisories
• Board decisions (stipulated orders, PDFs)
• Regulations and rulemaking packages
• Delete Act and DROP updates for data brokers
• Board meeting agendas and materials

Cadence. About three newsroom items a month. Nine board decisions in 2025 and nine in 2026 through August. The board meets every other month. Data-broker registration runs January 1 to 31 each year.

What to treat as urgent

• Enforcement advisories, which signal the next sweep.
• Board decisions against businesses in your sector; the data-broker 'enforcement blitz' has been continuous since late 2025.
• Regulatory deadlines: ADMT obligations January 1, 2027; first risk-assessment attestations April 1, 2028.

Quirks worth knowing

• Two domains; the registry counter on the old site is unreliable.
• Some orders are hosted on other state domains.
• Rulemaking surfaces first as board-meeting agenda items.

Subscribe at the source

• Newsroom
• RSS (newsroom, blog and decisions mixed)
• Email lists
• Board decisions

Official site: privacy.ca.gov