Where the CPPA's Rulemaking Authority Comes From, and What It Covers

A Grant Written Into the Initiative

The California Privacy Protection Agency exists because of a ballot measure rather than a bill. Civil Code section 1798.199.10, added by Proposition 24 on November 3, 2020 and operative from December 16, 2020, opens: "There is hereby established in state government the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018."

That sentence covers implementation and enforcement in general terms. The specific power to write regulations is granted separately and on different terms, and the distinction is the reason the agency's regulations did not appear for another two and a half years.

Section 1798.199.40 lists twelve functions the agency "shall perform," running from subdivision (a), to "[a]dminister, implement, and enforce through administrative actions this title," through public awareness work, guidance to consumers and businesses, the appointment of a Chief Privacy Auditor, technical assistance to the Legislature, monitoring of technological developments, cooperation with other privacy authorities, a voluntary certification mechanism for entities below the statutory business thresholds, and grant administration. Subdivision (l) is a residual clause directing the agency to "[p]erform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdiction and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses."

The Condition the Transfer Ran On

Rulemaking sits at subdivision (b), and it is the only function in the list with a trigger attached. The agency is to "[o]n and after the later of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185."

Section 1798.185, subdivision (d), states the other half of the arrangement — that the power being assumed came from somewhere. "Beginning the later of July 1, 2021, or six months after the agency provides notice to the Attorney General that it is prepared to begin rulemaking under this title, the authority assigned to the Attorney General to adopt regulations under this section shall be exercised by the California Privacy Protection Agency." The same subdivision sets July 1, 2022 as the timeline for adopting final regulations, and provides that civil and administrative enforcement of the provisions added or amended by Proposition 24 "shall not commence until July 1, 2023, and shall only apply to violations occurring on or after that date."

The agency's own record supplies the dates on which the condition was satisfied. Its account states that "[o]n October 21, 2021 the Agency provided formal notice to the California Attorney General that it is prepared to assume rulemaking activities under the CCPA," and that "[o]n April 21, 2022, rulemaking authority under the CCPA formally transferred to our Agency, pursuant to the CCPA, as provided for by the CPRA." Six months after the notice is exactly the interval subdivision (b) describes.

What Section 1798.185 Directs, and What It Merely Permits

Section 1798.185, subdivision (a), is where the substance of the rulemaking mandate sits. It directs the adoption of regulations "to further the purposes of this title, including, but not limited to," twenty-one enumerated areas. They range from housekeeping — updating or adding categories of personal information and sensitive personal information "in order to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns," and updating definitions as needed — to substantial policy assignments.

Two of the later paragraphs show how far the list reaches. Paragraph (20) directs the agency to review existing Insurance Code provisions and regulations relating to consumer privacy, excluding those relating to insurance rates or pricing, "to determine whether any provisions of the Insurance Code provide greater protection to consumers than the provisions of this title," and then to "adopt a regulation that applies only the more protective provisions of this title to insurance companies," while preserving the Insurance Commissioner's jurisdiction over rates and pricing. Paragraph (21) directs "[h]armonizing the regulations governing opt-out mechanisms, notices to consumers, and other operational mechanisms in this title to promote clarity and the functionality of this title for consumers."

The phrase "including, but not limited to" matters to the shape of the authority. The twenty-one paragraphs are a floor of assigned subjects rather than a ceiling on what regulations may address, and the agency's packages have in practice combined several of them at once.

The Board That Exercises It

Section 1798.199.10(a) provides that the agency "shall be governed by a five-member board, including the chairperson," and distributes the appointments across four offices: "The chairperson and one member of the board shall be appointed by the Governor. The Attorney General, Senate Rules Committee, and Speaker of the Assembly shall each appoint one member." The statute adds that "[t]hese appointments should be made from among Californians with expertise in the areas of privacy, technology, and consumer rights," and subsection (b) required initial appointments within 90 days of the effective date.

One feature of that structure is worth naming precisely: the Attorney General appoints one of the five members of the body that now exercises rulemaking authority formerly assigned to the Attorney General. The offices are separate, and the appointment power is a single seat rather than control of the board.

The Administrative Procedure Act Path

The agency describes itself as "authorized to adopt and amend regulations through the Administrative Procedures Act rulemaking process under both laws" — the CCPA and the Delete Act, the latter carrying obligations unique to data brokers. That places its rulemaking on the ordinary California path: a proposed text and notice, a public comment period, a rulemaking file, and review by the Office of Administrative Law before the regulations are filed with the Secretary of State and become effective.

The first exercise of the transferred authority was administrative rather than substantive. The agency's record states that "[o]n May 5, 2022, the California Office of Administrative Law (OAL), pursuant to Section 100 of OAL's regulations, approved the transfer of the existing CCPA regulations to Title 11, Division 6, a new division of the California Code of Regulations that is under the jurisdiction of the Agency." The agency characterises the change carefully: "While these amendments are non-substantive and merely renumber the existing CCPA regulations, they represent the beginning of the Agency's rulemaking role." The action is recorded as OAL matter 2022-0325-02NR, a Notice of Approval of Changes Without Regulatory Effect, and is accompanied by an explanatory statement and a renumbering chart.

Authority the Agency Shares With the Attorney General

The transfer in section 1798.185(d) moved "the authority assigned to the Attorney General to adopt regulations under this section." It did not repeal the Attorney General's separate regulatory power. Subdivision (b) of the same section states, without a date or a condition: "The Attorney General may adopt additional regulations as necessary to further the purposes of this title."

Subdivision (c) addresses enforcement rather than rulemaking, providing that the Attorney General "shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner." Read together, the three subdivisions describe a division in which the mandatory rulemaking programme sits with the agency, a residual regulatory power remains with the Attorney General, and enforcement authority is not confined to either office by the rulemaking provisions.

What Has Been Adopted, and What Is Only Being Explored

The agency's published record separates three categories, and the distinction between them is the practical answer to what its authority has produced. Nine completed rulemaking packages are listed: a Data Broker Registration Fee Regulation of December 2025; the Accessible Deletion Mechanism, or Delete Request and Opt-out Platform, system requirements of November 2025; the CCPA Updates, Insurance, Cybersecurity Audits, Risk Assessments and Automated Decisionmaking Technology package of September 2025; a Data Broker Registration Fee Regulation and Data Broker Registration Regulations, both of December 2024; an earlier Data Broker Registration Fee Regulation of January 2024; the California Consumer Privacy Act Regulations of March 2023; the Transfer of Rulemaking Authority and New Division package of April 2022; and a Conflict of Interest Code Regulation of February 2022.

Five subjects sit at the preliminary stage, which the agency describes as "topics that CalPrivacy is exploring to determine whether regulatory changes are necessary," adding that "[p]roposals appearing below have not yet advanced to formal rulemaking." They are Data Broker Audits, with a preliminary comment period closed May 7, 2026; Employee Data and Notices and Disclosures, both closed May 20, 2026; and Reducing Friction in the Exercise of Privacy Rights and Opt-out Preference Signals, both closed April 6, 2026.

Between those two categories the agency lists nothing. Proposed regulations are defined on the same page as "draft regulations proposed by the Agency that are currently in the formal rulemaking process but have not yet been adopted and are therefore not in effect," and the entry reads: "The Agency does not have any proposed regulation packages at this time." Five subjects have drawn public comment without a proposed text following, which is a different posture from a rulemaking under way.

The current regulations and the underlying statutes carry a common date on the agency's page — the CCPA, the CCPA regulations, the Delete Act and the Delete Act regulations are each listed as effective January 1, 2026.

Frequently Asked Questions