RegPing
Primary sources, polled every 30 minutesJSON · Sitemap · llms.txt · Status

AI & Privacy · guide

How to monitor CPPA enforcement and California privacy rulemaking

Updated

California has two privacy enforcers, and they publish separately. The California Privacy Protection Agency (CPPA) handles CCPA/CPRA rulemaking and administrative enforcement; the California Attorney General brings civil enforcement actions and issues advisories. Watching only one means missing half the picture.

What each publishes

CPPA

  • Rulemaking packages (proposed regulations, comment periods, adopted text) — including risk assessments, cybersecurity audits and automated decision-making rules.
  • Enforcement advisories and enforcement actions (administrative fines).
  • Board meeting agendas and materials, which preview upcoming priorities.

California Attorney General

  • Press releases announcing settlements and lawsuits under the CCPA and other privacy statutes.
  • Enforcement advisories and sweeps (e.g., on specific industries or practices).

Signals worth an alert

  • A proposed regulation with a comment deadline — the window to influence it is short.
  • An enforcement action in your industry or against a practice you use (dark patterns, opt-out handling, data broker registration, sale/share of data).
  • A sweep announcement — the AG often warns before it acts.
  • Board agenda items that mention your sector.

Beyond California

Multi-state AG actions and EU developments (EDPB guidance, GDPR fines, the EU AI Act's phased obligations) often move in parallel with California. A monitoring stream that covers the CPPA, the California AG, the EDPB and a multi-state aggregator gives a privacy lead one place to look. RegPing AI & Privacy does this and lets each server filter by jurisdiction and topic.

Practical routine

  1. Alerts into a channel the privacy lead reads daily.
  2. A weekly review of proposed rules and comment deadlines.
  3. Log enforcement actions against your data-map to see which practices are exposed.

Not legal advice — the agency's own publication is authoritative, and your counsel should weigh in on anything that changes a process.

Not legal advice. RegPing republishes and summarizes public regulator notices and links to the original. Summaries are produced with a language model and can be wrong; the regulator's text controls. Not legal advice. Consult counsel before acting.