CPPA board backs support for location, neural‑data and data‑broker reforms; conditions support for AI security bill

The California Privacy Protection Agency board on May 1 authorized staff to support a set of bills the agency says would strengthen consumer privacy, and to conditionally back a separate cybersecurity bill only if lawmakers grant the agency enforcement authority.

The board voted to instruct staff to support AB1355, a location‑privacy bill that would limit collection and sales of precise location information; SB44, which adds neural data protections and requires deletion of neural data once its original purpose is fulfilled; SB361, which would expand disclosures required of data brokers under the Delete Act; and SB470, which would extend current teleconferencing flexibilities through 2030. The board also directed staff to support SB468 — a bill that would require deployers of certain high‑risk AI systems to implement information‑security programs — only if the legislature amends it to give CPPA enforcement authority. The measure was adopted on a roll call vote, 4–0, with board member Lebert recusing himself.

"Our statute both empowers and directs us to engage in this cooperation," Executive Director Tom Kemp said in opening remarks after announcing an international cooperation declaration with the UK Information Commissioner’s Office. Kemp told the board the agency "opened formal rulemaking last Friday, April 25th" for the Delete‑Act style DROP platform; the DROP rulemaking’s public comment period runs through June 10 and the agency plans a hybrid public hearing that day.

Deputy Director for Policy and Legislation Marine Mahoney briefed the board on federal and state trends and explained staff recommendations on individual bills. She told board members some bills overlap with CPPA regulations but that staff judged a set of proposed laws to meaningfully advance privacy protections and to warrant a support position by the agency.

Board members asked staff to continue engagement with bill authors and to seek technical fixes where statutes otherwise create overlap or uncertainty about enforcement responsibilities. Several members highlighted the importance of CPPA enforcement expertise if the legislature places privacy obligations in other parts of the California code.

The motion instructs staff to continue supporting the listed bills and to withdraw support if amendments make a bill inconsistent with the objectives set out in staff memoranda and the board’s discussion.

What’s next: The bills will continue through the legislature’s committee and floor processes; staff will track amendments and has authority to update positions as the text evolves.

Vote: Motion moved by Mr. Worth, seconded by Dr. Nanaki. Roll call: McTagert — yes; Naniki — yes; Worth — yes; Chair Urban — yes; Lebert — recused. Outcome: approved (4–0, one recusal).

Authorities and bills referenced in the meeting: AB1355 (location privacy), SB44 (neural data), SB361 (data broker registry / Delete Act), SB468 (high‑risk AI security; staff recommended support if amended to add CPPA enforcement), SB470 (teleconferencing extension).