CPPA outlines DROP platform and rulemaking; businesses warn of heavy compliance costs

The California Privacy Protection Agency (CPPA) briefed Assembly Budget Subcommittee No. 5 on implementation steps required by the Delete Act (adopted in 2023) and sought expenditure authority and positions to develop an accessible Delete Request and Opt‑Out Platform ("DROP").

Vaughn Chitambira, deputy director of administration at CPPA, said the Delete Act transferred responsibility for the data‑broker registry from the Department of Justice to CPPA and required an accessible mechanism for consumers to request deletion of personal information beginning Jan. 1, 2026. CPPA is partnering with the California Department of Technology and will leverage CDT's Office of Digital Services to build the platform under an interagency agreement. The agency requested $2,400,000 from the Data Broker Registry Fund in 2025‑26 and $2,300,000 in 2026‑27 and two positions phased in over two years to meet Delete Act deadlines.

Committee members asked about oversight because the project development is being provided by CDT while CPPA is the delegated project owner. CPPA explained that the project was delegated back to the agency in the project approval lifecycle and that CPPA—not CDT—retains governance, risk management and final responsibility; CDT provides technology development through an IAA and the Office of Digital Services. CPPA said delegated projects report periodically to CDT and that memorandum‑of‑understanding and segregation‑of‑duties provisions are in place to maintain oversight.

CPPA also described ongoing rulemaking on automated decision‑making technology (ADMT), including opt‑out mechanisms and risk assessments for businesses. CPPA said it received comments from approximately 200 stakeholders and will consider changes at the board's next meeting in early April.

Business groups and chambers submitted comments at the hearing and by letter requesting that the Legislature maintain budget oversight. Representatives from the California African American Chamber of Commerce, the California Hispanic Chambers of Commerce, and small‑business speakers urged the subcommittee to keep the CPPA budget open, saying proposed ADMT regulations could impose significant costs on small businesses, reduce competitiveness and result in job losses. CPPA said it is reviewing public comment and seeking to "get this right." The agency acknowledged the public concerns and said it will consider modifications to reduce unintended economic impacts.

CPPA said DROP development is on a delegated project timeline with CDT providing development capacity via an interagency agreement; the agency asked the subcommittee to approve the requested positions and funding to meet statutory deadlines.