[{"_1":2,"_112":-5,"_113":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,76,88,100],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},"mediaId",6151925,"mediaKeyId","5500905-9da712516a35e2d5df7fdd61c2cda495","parentId",5500905,"title","CPPA board backs ban on sale of precise geolocation and conditions support for bulk deletion for officials","audioSeconds",1586,"startMs",4680000,"endMs",6266000,"viewUrl","/Search/View?dp=1&key=5500905-9da712516a35e2d5df7fdd61c2cda495&start=4680&end=6266","thumbnailUrl","https://assets.pipeline.soar.com/5500905-9da712516a35e2d5df7fdd61c2cda495/thumbnail_4680000.jpg","articleUrl","/articles/6151925/California/CPPA-board-backs-ban-on-sale-of-precise-geolocation-and-conditions-support-for-bulk-deletion-for-officials","mediaUrl","https://secure.pipeline.soar.com/6151925-695624994143c1d0502f8282e77ffe81/orig.mp4?Expires=1770982614&Signature=TVlSI-IB5acPZhPw8mZ2sk-UJStgEIkDexCs9-Ere9I4bvE6dqLyAmFuvAE5p7mtJ9Jo8BzA7Y65mCJoT~YhLicFBL4dOCsI3iZgXz1SzkYnedrpT6woD7S6gg~HKYFyguHyQNK59BsMNpVnq8oG9A3r3dpLZxH1Ly2ncCjZ7hEUJAKU0j4lhMNPqYL9VdiF~1mVMbHwW7CwvWwfA0Gm8QlzhbZHI~0RP39SDqvSYQHyu6UV2Cnr2TKG1FNuLwVeeE7za~a22f5vZPolQ7KWMk4dYBsdS2w~jsxTSwz3LhprbYSnp~RbLCn1bu39Om-bbgcIuZNYU3IpFjI9QSzzsw__&Key-Pair-Id=KUT5TJCACFTXG","author","California Privacy Protection Agency","date","2025-07-28T15:48:58Z","article","At its July meeting the California Privacy Protection Agency board voted to support AB 322, a bill that would amend the CCPA to restrict the collection, retention and sale of precise geolocation data, and to authorize staff to take a support‑if‑amended position on AB 302, a bill that would add a pathway for bulk deletion requests for public officials and judges.

Deputy Director for Policy Maureen Mahoney briefed the board on both measures and recommended the board consider formal positions. On AB 322 staff said the bill would (as amended) require businesses to collect and retain only geolocation data necessary to provide a requested service and would prohibit sale of precise geolocation information.

On AB 302 — a bill that had been gutted and amended — staff described four central provisions: the bill would (1) direct the agency to obtain and maintain lists of state and local elected officials to submit DROP deletion requests on their behalf by March 1, 2026 and after each election; (2) require the agency to accept a list of judges from the Judicial Council and submit deletion requests on their behalf; (3) require DROP to notify data brokers of these requests and require broker responses within five days; and (4) require a secure, confidential exchange for the information.

Staff raised concerns and suggested the board seek amendments that would assign list maintenance to an existing entity, add verification steps consistent with the rest of the Delete Act, and extend deadlines tied to technical development timelines. Mahoney told the board the author had indicated a willingness to work with staff on verification and other technical concerns.

After discussion the board voted separately on the bills. Board Member Worth moved to authorize staff to support AB 322; McTaggart seconded. The vote was 4 yes, 1 abstention (Board Member Liebert recused) and the motion carried. Chair Urban then called for a separate motion to authorize staff to take a support‑if‑amended position on AB 302, incorporating staff’s recommended amendment criteria and permitting staff to move to support or opposition if amendments are inconsistent with agency objectives. That motion passed 5‑0.

Board members debated both the merits and risks of AB 302. Some members said the bill’s goals — protecting public officials from targeted violence — were important, while others worried the agency lacked the legal or technical groundwork to manage large, government‑supplied deletion lists on the accelerated timelines proposed in the bill.

Why it matters: AB 322 would extend sensitive‑data protections to location information, a category advocates and staff said is particularly revealing of private life and activities. AB 302 raises procedural and technical questions about who should maintain lists of officials and how DROP should verify and process bulk deletion requests.

Outcome: The board signaled clear support for limiting commercial sale of precise geolocation data and authorized staff to negotiate specific amendments and positions on AB 302 that protect against fraud and meet technical requirements.

Ending: Staff will work with legislative offices and report back on negotiated amendments; board members asked staff to keep the board informed as amendments are drafted and votes advance.","mediaType","Video","parentTitle","July 24, 2025 - California Privacy Protection Agency - Board Meeting","oneSentenceSummary","The CPPA board voted to support a bill that would ban sale of precise geolocation data and authorized staff to take a conditional support position on a separate bill to allow bulk deletion requests for public officials, subject to technical and verification amendments.","taxTitle","California Privacy Protection Agency, Other State Agencies, Executive, California","taxId",76728,"location","California","headline","","shortSummary",{"_33":77,"_35":36,"_37":38,"_39":78,"_41":79,"_43":80,"_45":81,"_47":82,"_49":83,"_51":84,"_53":85,"_55":56,"_57":58,"_59":86,"_61":62,"_63":64,"_65":87,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6151929,"CPPA reports staff growth, budget increase and data‑broker fee revenue; board hears staffing shortfalls for DROP and enforcement",983,1282000,2265000,"/Search/View?dp=1&key=5500905-9da712516a35e2d5df7fdd61c2cda495&start=1282&end=2265","https://assets.pipeline.soar.com/5500905-9da712516a35e2d5df7fdd61c2cda495/thumbnail_1282000.jpg","/articles/6151929/California/CPPA-reports-staff-growth-budget-increase-and-databroker-fee-revenue-board-hears-staffing-shortfalls-for-DROP-and-enforcement","https://secure.pipeline.soar.com/6151929-deea1a0a9d546d43f3ce5c52d0ebe45d/orig.mp4?Expires=1770982614&Signature=D2tGmTB~pqLmWePHeHQh1zjqcx-s9M9-H6l3cBhR5gPjlkS3R9wBGyqXUk9WnNqgUhnPSNyWcRvDUFgAOIPCFCRzTe0S81tT3HDxCcOnlA9PvBvlGq8JMF6~PJUWgjZB7fFimbxuMG9aLUHD8jV6XP0BGvW1~s9v7soCB9OD3Nse1dKislVJZ-pVfHxcYCI1H9FapRQtS6JKAzbHl5qI8qL8Vhnu87EEg8Z906MFaU0Xii-RxBn2xgn8pyQ6K1pjjkAhMYh6P9JNXb8sNTwZDjWmEEbPSLhVU8ZKZBqFukjTvd~n-ldi32c1~B6XLgRfzwlKs4F020Sj33i09~ZtgQ__&Key-Pair-Id=KUT5TJCACFTXG","The California Privacy Protection Agency on Thursday presented an annual administrative and budget update that detailed staffing, office leasing plans, and funding for the Delete Request and Opt‑Out Platform (DROP) and enforcement infrastructure.

Deputy Director of Administration Von Chidambira told the board the agency has 53 authorized positions — 43 permanent, four temporary and one intern — and that 23 employees were onboarded in the prior year as the agency scaled up. Total expenditures for fiscal year 2024–25 were reported at $14,190,000, Chidambira said, noting accounting books were still closing and figures could be adjusted slightly.

Chidambira said the agency received roughly $3,600,000 from data broker registration and associated penalties in 2025 (about $3,400,000 in registration fees and roughly $170,000 in fines and penalties). The agency also reported a consumer privacy fund balance set at $400,000 for the current fiscal year.

On DROP funding, staff said the budget change proposal (BCP) requested two positions and $4,800,000 over two years to cover development, residency verification, CDT project management, ID verification costs, and operating expenses. A separate BCP requested $700,000 from the consumer privacy fund over two years to build enforcement infrastructure, including data analysis tools.

Chidambira also described facilities plans: the Sacramento office is moving from temporary space at 400 R to a permanent leased site; the lease award and tenant improvements were under review with an anticipated mid‑August 2025 lease signature and a projected move into permanent space in August 2026.

Board members pressed staff on whether the proposed staffing levels are sufficient for DROP and enforcement work. Board Member Worth said he was concerned that two to four dedicated employees for DROP “is not enough people” to run what the board had described as a globally novel one‑stop deletion portal. Chidambira replied that two staff are dedicated now, two more are being recruited, and that ongoing CDT contracts and project management support account for a significant portion of implementation capacity.

Budget totals: staff said the approved budget for fiscal year 2025–26 is $15,770,000 spread across three funds (general fund, data broker registry fund and consumer privacy fund). Chidambira noted a facilities and departmental services line in the general fund and said operating expenses in the data broker fund are concentrated on DROP development, ID verification, and CDT costs.

Why it matters: the expenditure and fee figures indicate how CPPA will fund implementation of statutory programs such as DROP and how much in‑house capacity it plans to have for enforcement and procurement work. Several board members urged staff to pursue further resources for procurement, legal, and enforcement functions.

Ending: Staff said it will continue to refine long‑term expenditure plans and return to the board with additional budget requests and updates as they build the platform and enforcement infrastructure.","CPPA reported 53 authorized positions and FY 2024–25 expenditures of $14.19 million, and said it collected approximately $3.6 million in data‑broker registration fees in 2025 while seeking $4.8 million over two years for DROP implementation.",{"_33":89,"_35":36,"_37":38,"_39":90,"_41":91,"_43":92,"_45":93,"_47":94,"_49":95,"_51":96,"_53":97,"_55":56,"_57":58,"_59":98,"_61":62,"_63":64,"_65":99,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6151931,"CPPA outlines DROP rollout, requires residency checks and stricter matching for bulk deletions",12952,381000,13333000,"/Search/View?dp=1&key=5500905-9da712516a35e2d5df7fdd61c2cda495&start=381&end=13333","https://assets.pipeline.soar.com/5500905-9da712516a35e2d5df7fdd61c2cda495/thumbnail_381000.jpg","/articles/6151931/California/CPPA-outlines-DROP-rollout-requires-residency-checks-and-stricter-matching-for-bulk-deletions","https://secure.pipeline.soar.com/6151931-316f9d85db1ec73e12fec80a14668320/orig.mp4?Expires=1770982614&Signature=YpAZgSufIvKbZfVMvmtenrtpZ7c8mpz3r0FhVeysqkwIFS-o3d1t54KWD1z5HdUAlHpw56kCmrXcnETvaaFM6sEsj-AI7gx-w422cieb5ExiKlZHMCIj4bmyha-H99VaZFQ0osValZnKU~yb0OLrTexf3NaNuBFKDF6JphzifQoxguuFDC8g8lgTIOJbLY0oEIIko39M33alTsiW9Ihal3-b~FSStK9wqM0k069dccK~SaUoeC~3SIPyj-PR36YAiVEO-iXVO673Aup49nEYTpHjpazEUiZOLIK3Ql92sZJAT1u3NehSrNEpItrnpt63-m1h3~whwDM6vk6KyhSvXw__&Key-Pair-Id=KUT5TJCACFTXG","The California Privacy Protection Agency on Thursday detailed changes to its planned Delete Request and Opt‑Out Platform (DROP), saying the portal will begin accepting consumer requests in 2026 and proposing tighter technical controls to avoid erroneous deletions.

At the board meeting, CPPA staff described system changes that include a requirement that the agency verify a consumer’s California residency before forwarding a bulk deletion request to registered data brokers, a prohibition on using partial hashed matches when multiple identifiers are combined, and new standards allowing data brokers to share suppression lists with their subcontractors so downstream vendors do not repopulate deleted records.

The modifications followed a 45‑day public comment period that produced about 176 pages of feedback from 19 commenters, according to staff. Staff said it would publish revised regulatory text and open a new 15‑day comment window so the public and registered brokers can review the proposed changes before the rules move to the Office of Administrative Law.

CPPA Executive Director Tom Kemp explained the tradeoffs the agency is trying to manage. \"Californians want their personal information to be used only for the purposes they specify,\" Kemp said, noting the agency’s goal to balance robust privacy protections with technical safeguards to prevent fraud or mistaken deletions.

Staff said the system will accept multiple identifiers (for example, several email addresses or name spellings) to increase match rates, but clarified that when a consumer provides a combined deletion identifier set the platform will require a 100% match on that combined hashed value before ordering deletion. \"This change reflects the functionality of the DROP system and minimizes the risk of erroneous deletions for data brokers,\" privacy fellow Gary Lee told the board.

Other clarifications in the draft text include standardized comparison rules for brokers to determine whether they hold a consumer’s data and a requirement that authorized agents may support a consumer’s DROP request only after the consumer’s residency has been verified. Staff also proposed status reporting so consumers can see whether brokers have matched, deleted, or declined to delete flagged records.

The board voted 5‑0 to direct staff to publish the modified text for a further comment period and to continue preparing the rulemaking package. The motion was made by Board Member McTaggart and seconded by Board Member Nonnecke.

Why it matters: DROP is intended to let Californians submit a single deletion or opt‑out request to multiple data brokers. The system’s design choices — how it matches consumers to broker records and how it prevents fraud or mistaken deletions — determine both how effective DROP is in practice and how many records brokers will have to flag or retain to satisfy subpoenas, investigations or legal exemptions.

What’s next: Staff will post revised text for a 15‑day comment period and said it will keep working with data brokers and technology partners to test hashing and matching approaches ahead of the law’s January 1, 2026, DROP launch. Staff also noted the statute requires audits of brokers in later years and that enforcement mechanisms remain part of the agency’s oversight toolbox.

Ending note: The board emphasized that the DROP rollout must protect Californians while avoiding technical designs that produce large numbers of false matches or deletions. The new text will return to the public and be updated again before final submission to the Office of Administrative Law.","The California Privacy Protection Agency on Thursday described technical and regulatory changes to its Delete Request and Opt‑Out Platform (DROP), including residency verification and stricter hashed‑matching rules, and directed staff to publish revised text for a 15‑day public comment period.",{"_33":101,"_35":36,"_37":38,"_39":102,"_41":103,"_43":104,"_45":105,"_47":106,"_49":107,"_51":108,"_53":109,"_55":56,"_57":58,"_59":110,"_61":62,"_63":64,"_65":111,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6151919,"CPPA adopts automated‑decision and cybersecurity audit rules after contentious public comment",6020,6922000,12942000,"/Search/View?dp=1&key=5500905-9da712516a35e2d5df7fdd61c2cda495&start=6922&end=12942","https://assets.pipeline.soar.com/5500905-9da712516a35e2d5df7fdd61c2cda495/thumbnail_6922000.jpg","/articles/6151919/California/CPPA-adopts-automateddecision-and-cybersecurity-audit-rules-after-contentious-public-comment","https://secure.pipeline.soar.com/6151919-8ea53fe3db4119d8b9a9aeed5b879937/orig.mp4?Expires=1770982614&Signature=Mgyin2ilepFDkKpjv2Ajl3wsHLQ5yFVLLobU4dkphXCWJN2Rll7YLlzxxOZG-a7Ka5fvHrMeSf-5cu6IQ7aRzf8nz-CYu9sMKFhHh9XJ~oZ1~Yet73YHmjN0XCxwDvr7E0cdYuSJ5QmNCE7sVeuUIw12gOSgp78Lc0f7OdLWjngzypztXxkEOykIECabblq5WSUQHZpXzJj4yV6ugaq4lleDk7ODFybIjpwXgjRxEePohzX~cUdS4bfkot264hsoD4aEO2FplxSc2WbGYoCHPpEjY~IoFFd9WDbWIjncT4cnX-4pmnLRH6-WJTkc73bW-6pYpyxlRiDFOKvQZIZIbA__&Key-Pair-Id=KUT5TJCACFTXG","The California Privacy Protection Agency adopted a package of regulations on automated decision‑making technology (ADMT), risk assessments and cybersecurity audits at its July 24 meeting after an extended public comment period and vigorous debate.

The final package narrows some original proposals, including phasing cybersecurity audits by revenue level, removing a behavioral advertising threshold for ADMT obligations, and focusing ADMT requirements on use for \"significant decisions.\" Agency staff said those and other revisions cut estimated direct business compliance costs from the initial projection of more than $10 billion to about $4.8 billion over 10 years and that aggregate net benefits rise substantially under updated modeling.

Board members praised the staff's lengthy drafting effort. \"I support adopting these thoughtful, and I say balanced and privacy focused regulations today,\" Board Member Liebert said during deliberations.

But the adoption took place amid strong public opposition from labor and civil‑society groups, and wide disagreement among business associations. Worker advocates, several unions and gig‑worker speakers urged stronger rules, saying narrow definitions will let employers and platforms avoid obligations and deny workers notice, recourse and access to data used by algorithms that affect pay, discipline or deactivation. Dozens of labor, consumer and civil society organizations had submitted coalition comments and told the board the proposed changes had weakened worker protections compared with earlier drafts.

Gig workers and union representatives told the board they face real harms from automated systems that set pay rates, route work or deactivate accounts, and asked for broader notice, access, and stronger opt‑out and audit requirements. For example, driver Darius Mobareke told the board, \"I want access to my life. I want access to my story. I want access to my data,\" and described difficulties obtaining information from platforms about how algorithmic decisions affected his work.

Industry groups argued the rules remain too prescriptive and costly, warned of duplicate federal and state obligations for regulated sectors, and urged longer compliance timelines. Several business associations asked that the agency pause and coordinate with the governor’s AI working group and the legislature to avoid regulatory conflict.

Staff reported the agency received about 575 pages of comments from 70 distinct commenters during the most recent (24‑day) public comment period and noted many prior rounds of pre‑rulemaking comment dating back to 2021. After discussion the board voted 5‑0 to adopt the regulations as modified and to direct staff to submit the final rulemaking package to the Office of Administrative Law.

Why it matters: The ADMT and cybersecurity rules implement voter‑authorized agency powers and will affect how companies use algorithms that make or influence consequential decisions about consumers and workers across California. The rules establish notice, risk‑assessment, external review and phased audit obligations that will become compliance landmarks for the state.

What’s next: Staff will package final statements of reasons and supporting documents and submit them to OAL. The agency also will monitor effects in the field and indicated it is prepared to propose future amendments if the rules prove impracticable or fail to address emerging harms.

Ending: The adoption marks a milestone in California’s attempt to regulate algorithmic decision making and cybersecurity practices; it also signals further enforcement and oversight work as the new rules take effect.","After years of drafting and more than 500 pages of recent comments, the CPPA board voted 5‑0 to adopt regulations governing automated decision‑making technology (ADMT), risk assessments, and phased cybersecurity audits. Labor and consumer groups told the board the package had been weakened; industry groups urged further narrowing and more time.","actionData","errors"]

Article not found

CPPA board backs ban on sale of precise geolocation and conditions support for bulk deletion for officials

CPPA reports staff growth, budget increase and data‑broker fee revenue; board hears staffing shortfalls for DROP and enforcement

CPPA outlines DROP rollout, requires residency checks and stricter matching for bulk deletions

CPPA adopts automated‑decision and cybersecurity audit rules after contentious public comment