Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Enforcement topic
No spam. Unsubscribe anytime.
CPPA enforcement reports rising complaints and a flurry of actions; data‑broker strike force ongoing
Summary
Enforcement staff told the board the complaint portal has logged 12,546 complaints since launch, with a roughly 125% year‑over‑year increase; the division has stepped up investigations and brought several recent enforcement actions including against data brokers and large companies.
Deputy Director of Enforcement Mike Mackow presented the agency’s annual enforcement update and priorities, highlighting growing complaint volume and recent cases.
"Through the March, so through the end of last month, we've now received 12,546 consumer complaints in total going back to when we launched the system," Mackow said, and described a near‑term year‑over‑year increase in complaints of about 125 percent. He said the most common complaint categories continue to include the right to delete and concerns about collection, use and sharing of personal information.
Mackow described staffing and organizational changes: the enforcement division has recruited research technologists (PhD‑level) to analyze data flows and support investigations, partnered with California universities to supplement technical capacity, and is seeking further hiring through the governor’s budget (5 additional attorneys and one legal support professional proposed).
He summarized recent enforcement activity and priorities: the agency has pursued multiple actions against data brokers under the Delete Act and brought cases against firms including Tractor Supply Company (fine noted in transcript, $1,350,000), Ford Motor Company, PlayOn Sports (a digital ticketing platform), DataMasters (a broker that sold lists of vulnerable groups), S&P Global (unregistered), and ROR Partners. Mackow said the agency launched a data broker enforcement strike force and will devote significant resources to monitoring broker compliance once Drop deletions begin.
Board members asked about how the enforcement team triages high complaint volumes, whether AI tools could assist with intake and prioritization, and the agency’s plan for broader sweeps to identify low‑hanging compliance issues (for example, obvious website notice failures). Mackow said staff use targeted investigations and technical tooling to identify patterns, and acknowledged opportunities to scale intake triage and investigative sweeps.
What’s next: enforcement staff will prioritize cases that build precedents across industries, coordinate audits and enforcement work, and target data broker compliance around the Drop implementation.
