Privacy agency seeks funds for data-broker deletion platform while business groups urge delay over proposed AI rules

The California Privacy Protection Agency told the Senate budget subcommittee it is developing an accessible deletion mechanism required by the Delete Act and requested funding to meet the statutory deadline, while representatives of business groups urged the committee to keep the CPPA budget open until regulatory concerns are resolved.

CPPA presentation and request: Vaughn Chitambira, deputy director for administration at CPPA, told the committee the agency requests $2.4 million from the Data Broker Registry Fund for 2025'26 and $230,000 in 2026'27, plus two positions, to build and operate an accessible deletion mechanism required by statute beginning Jan. 1, 2026. The Delete Act, enacted in 2023, transferred responsibility for the data broker registry from the Department of Justice to CPPA and requires an accessible mechanism to allow consumers to request deletion of personal information maintained by registered data brokers.

Delegation, interagency agreement with CDT: Brian Metzger of the LAO noted that CDT initially received delegation authority but that CDT delegated the software build back to CPPA; the two agencies now operate under an interagency agreement in which CDT provides project management and Office of Digital Services assistance. Metzger told the committee the arrangement is unusual because CDT normally provides oversight rather than building; the subcommittee may want reporting requirements akin to CDT's usual independent monthly oversight reports because CPPA has no previous IT project delivery record and this project has a statutory deadline.

Industry concerns about CPPA rulemaking: Several witnesses from business and chamber organizations urged the subcommittee to hold the CPPA budget pending changes to proposed regulations. Representatives from the California Hispanic Chambers of Commerce and the California African American Chamber of Commerce told the committee they are concerned CPPA has exceeded its authority by proposing provisions related to artificial intelligence (AI) and automated decision-making technology (ADMT) and that those provisions could impose large, ongoing compliance costs on small businesses. Witnesses cited estimates of statewide implementation costs and job impacts that they said would result if the regulations were finalized as proposed. The witnesses requested additional oversight and revision of CPPA regulations to reduce economic impacts and to clarify authority to regulate AI.

CPPA response and oversight: CPPA officials said they are collaborating with CDT and have interagency agreements that include weekly project meetings and monthly leadership reviews, with contractual options to cancel the work if it is not delivered on time. CPPA said it expects to meet the Jan. 1, 2026 implementation date and that controls exist within the IAA (interagency agreement) to monitor progress and provide recourse if CDT work does not proceed on schedule.

What the committee asked for: Lawmakers and LAO staff suggested the subcommittee consider provisional budget bill language or a reporting requirement to ensure the project remains on schedule because the agency delegated the project back to CPPA and the statute includes a hard deadline. CPPA and CDT representatives said they will provide additional status updates and work to meet the statutory deadline.

Ending note: Lawmakers left the CPPA budget item open for further oversight and indicated they want to see progress reporting to ensure the Delete Act'mandated deletion mechanism is delivered in time.