CPPA Structure and Authority
The California Privacy Protection Agency (CPPA) is the state government entity vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.
Governance and Board Composition
The CPPA is governed by a five-member board, including the chairperson. Board members are appointed as follows:
California Privacy Protection Agency (CPPA)
[1798.199.10] Agency Establishment
├─ (a) Five-member board governance
│ ├─ Chairperson + 1 member: Governor appointed
│ ├─ 1 member: Attorney General appointed
│ ├─ 1 member: Senate Rules Committee appointed
│ └─ 1 member: Speaker of Assembly appointed
│ Qualifications: privacy, technology, consumer rights expertise
Appointments are made from among Californians with expertise in the areas of privacy, technology, and consumer rights. Initial appointments were required within 90 days of the effective date of Proposition 24 (December 16, 2020).
Board Member Requirements and Qualifications
Members of the CPPA board must meet the following requirements pursuant to Section 1798.199.15:
(a) Qualifications and Skills
Board members must have qualifications, experience, and skills, particularly in the areas of privacy and technology, required to perform the duties of the agency and exercise its powers.
(b) Confidentiality
Members must maintain the confidentiality of information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure is required by the Public Records Act.
(c) Independence
Members must remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from another.
(d) Occupation Restrictions
Members must refrain from any action incompatible with their duties and engaging in any incompatible occupation, whether gainful or not, during their term.
(e) Information Access
Members have the right of access to all information made available by the agency to the chairperson.
(f) Post-Office Employment Restriction
Members are precluded, for a period of one year after leaving office, from accepting employment with a business that was subject to an enforcement action or civil action under this title during the member's tenure or during the five-year period preceding the member's appointment.
(g) Representation Restriction
Members are precluded for a period of two years after leaving office from acting, for compensation, as an agent or attorney for, or otherwise representing, any other person in a matter pending before the agency if the purpose is to influence an action of the agency.
Terms and Compensation
Board members, including the chairperson, serve at the pleasure of their appointing authority but shall serve for no longer than eight consecutive years.
For each day on which they engage in official duties, members of the agency board are compensated at the rate of one hundred dollars ($100), adjusted pursuant to subdivision (d) of Section 1798.199.95, and are reimbursed for expenses incurred in performance of their official duties.
Executive Leadership and Staff
The agency board appoints an executive director who acts in accordance with agency policies and regulations and with applicable law. The agency appoints and discharges officers, counsel, and employees, consistent with applicable civil service laws, and fixes the compensation of employees and prescribes their duties. The agency may contract for services that cannot be provided by its employees.
The agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority.
Agency Functions
The CPPA performs the following functions pursuant to Section 1798.199.40:
[1798.199.40] Agency Functions (12 enumerated)
├─ (a) Administer/implement/enforce title
├─ (b) Adopt/amend regulations (post-July 1 2021)
├─ (c) Protect fundamental privacy rights
├─ (d) Public awareness, risk assessment reports
├─ (e) Guidance to consumers
├─ (f) Guidance to businesses, Chief Privacy Auditor
├─ (g) Legislative technical assistance
├─ (h) Monitor privacy developments
├─ (i) Cooperate with other jurisdictions
├─ (j) Voluntary certification mechanism
├─ (k) Grant administration
└─ (l) All other necessary acts
(a) Administration and Enforcement
Administer, implement, and enforce through administrative actions this title.
(b) Rulemaking Authority
On and after the later of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185 to carry out the purposes and provisions of the California Consumer Privacy Act of 2018, including regulations specifying recordkeeping requirements for businesses to ensure compliance with this title.
(c) Privacy Rights Protection
Through the implementation of this title, protect the fundamental privacy rights of natural persons with respect to the use of their personal information.
(d) Public Awareness and Education
Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale, and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the agency pursuant to paragraph (14) of subdivision (a) of Section 1798.185 while ensuring that data security is not compromised.
(e) Consumer Guidance
Provide guidance to consumers regarding their rights under this title.
(f) Business Guidance and Auditing
Provide guidance to businesses regarding their duties and responsibilities under this title and appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance with this title pursuant to regulations adopted pursuant to paragraph (17) of subdivision (a) of Section 1798.185.
(g) Legislative Support
Provide technical assistance and advice to the Legislature, upon request, with respect to privacy-related legislation.
(h) Technology and Commercial Practice Monitoring
Monitor relevant developments relating to the protection of personal information and, in particular, the development of information and communication technologies and commercial practices.
(i) Interagency Cooperation
Cooperate with other agencies with jurisdiction over privacy laws and with data processing authorities in California, other states, territories, and countries to ensure consistent application of privacy protections.
(j) Voluntary Certification Mechanism
Establish a mechanism pursuant to which persons doing business in California that do not meet the definition of business set forth in paragraph (1), (2), or (3) of subdivision (d) of Section 1798.140 may voluntarily certify that they are in compliance with this title, as set forth in paragraph (4) of subdivision (d) of Section 1798.140, and make a list of those entities available to the public.
(k) Grant Administration
Solicit, review, and approve applications for grants to the extent funds are available pursuant to paragraph (2) of subdivision (b) of Section 1798.160.
(l) General Authority
Perform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdiction and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.
Funding and Budget
[1798.199.95] Appropriation and CPI Adjustments
├─ (a) Funding: $5M (FY 2020-21), $10M/year thereafter (CPI adjusted)
├─ (b) Budget Act inclusion (3 items)
├─ (c) Attorney General staff support (reimbursed)
└─ (d) CPI adjustment procedures
├─ (1) Adjustment trigger: Jan 1 odd-numbered years
│ Sections: 1798.140(d)(1)(A), 1798.150(a)(1)(A),
│ 1798.155(a), 1798.199.25, 1798.199.90(a)
├─ (2) Index: CPI-CA All Items, Aug-to-Aug, nearest dollar
├─ (3) Website posting: by Jan 15
└─ (4) Not subject to APA rulemaking
The General Fund appropriates to the agency the sum of five million dollars ($5,000,000) during the fiscal year 2020–21, and the sum of ten million dollars ($10,000,000) adjusted for cost-of-living changes, during each fiscal year thereafter, for expenditure to support the operations of the agency pursuant to this title.
The Department of Finance, in preparing the state budget and the Budget Act bill submitted to the Legislature, includes an item for the support of this title that indicates:
- The amounts to be appropriated to other agencies to carry out their duties under this title, which amounts shall be in augmentation of the support items of those agencies.
- The additional amounts required to be appropriated by the Legislature to the agency to carry out the purposes of this title, as provided for in this section.
- In parentheses, for informational purposes, the continuing appropriation during each fiscal year of ten million dollars ($10,000,000), adjusted for cost-of-living changes.
The Attorney General provides staff support to the agency until the agency has hired its own staff. The Attorney General is reimbursed by the agency for these services.
Cost-of-Living Adjustments
On January 1, 2025, and on January 1 of any odd-numbered year thereafter, the CPPA adjusts the monetary thresholds in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.140, subparagraph (A) of paragraph (1) of subdivision (a) of Section 1798.150, subdivision (a) of Section 1798.155, Section 1798.199.25, and subdivision (a) of Section 1798.199.90 to reflect any increase in the Consumer Price Index.
The agency uses the Consumer Price Index (CPI) - California, All Items, All Urban Consumers percentage change from the previous two years' reports, published by the Department of Industrial Relations, Office of the Director–Research. The agency applies the percentage change in the CPI for the August-to-August point in time of the prior two years. The increase in the thresholds is rounded to the nearest whole dollar.
The agency posts the adjusted monetary thresholds on its internet website no later than January 15 of the year in which the adjustment becomes effective. These adjustments and their publication are not subject to the rulemaking provisions of the Administrative Procedure Act.
Next Steps: Learn about the CPPA's enforcement powers in Investigation and Adjudication Procedures, or review the financial consequences of violations in Penalties and Damages.