State of CalPrivacy: Clarifying Regulation & Enforcement in 2026
summary
CalPrivacy unveils the DROP system — a web tool launched Jan 1 that records residency-verified deletion requests and already shows 215,000 registrations in 34–35 days; data broker registration closed Jan 31 and brokers must start processing DROP requests in August 2026. Regulations require risk assessments effective Jan 1, 2026 (attestations by Apr 1, 2028), staggered cybersecurity audits through 2028–2030, ADMT transparency rules starting Jan 1, 2027, a new audits division with a chief privacy auditor, and active enforcement (100+ investigations, ~10k complaints, nearly a dozen data broker cases, plus settlements and actions against retailers).
AI-written summary · about
chapters (17)
- 0:00Welcome to CalPrivacy 2026
- 1:08Tom Kemp’s first year
- 5:25California’s Delete Act enforcement
- 9:33Mistakes under data broker laws
- 11:39Risk assessments and cyber audits
- 16:17Submitting audit documentation
- 18:41Automated decision-making approach
- 21:09Enforcement case initiation
- 24:43CalPrivacy and Attorney General
- 26:29Settlement vs litigation
- 27:34Issuing enforcement advisories
- 29:03Global privacy regulator collaboration
- 31:36Opt-out mechanisms
- 36:12Employee data regulations
- 38:192026 organizational changes
- 40:47CalPrivacy’s 2026 priorities
- 44:24Engaging with CalPrivacy
related talks
40mWhat is New in California Privacy and What Does it Mean for the Company?
46mHow to Design and Execute Superior Employee Privacy Practices
55mBattle for online privacy
31mThe 2025 Privacy Regulatory Landscape: US and Europe
44mPanel Discussion – Data Policy and Global Data Privacy Developments
28mAdtech Privacy Risk: Increasing Regulation and Enforcement
46mDeveloping for Privacy
52mData Protection and Privacy Development Around the World