On February 28, 2025, the California Privacy Protection Agency (CPPA) published its annual report for 2024. The CPPA was very active last year, and we expect to see even more activity this year. Below are our biggest takeaways from the annual report. 

Enforcement of the Delete Act

California’s Delete Act, which went into effect on January 1, 2024, provides California consumers the right to request that data brokers delete their personal information.  Pursuant to the Delete Act, the CPPA launched a Data Broker Registry, which processed the registration of 543 data brokers in 2024. The CPPA plans to launch a first-of-its-kind deletion mechanism allowing consumers to request the deletion of their data across all registered brokers, known as the Delete Request and Opt-out Platform (DROP). Registered data brokers will use the platform to retrieve deletion requests at least every 45 days. 

In December 2024, the Data Broker Registration regulations took effect. The regulations clarify and expand existing registration requirements for data brokers and establish the 2025 registration fee to fund the data broker registration and DROP system.

CPPA enforcement priorities and sweeps

The CPPA’s Enforcement Division focuses on conducting investigations and stopping the improper use of personal information by businesses subject to California privacy laws. Based on the 2024 report, the Enforcement Division has the following enforcement priorities: 

• Review of privacy notices and privacy policies
• Implementation of consumer requests 
• The right to delete
• Selling or sharing personal information without proper notice or an opt-out mechanism
• Dark patterns/deceptive design
• Violations that affect vulnerable communities and groups 

The Enforcement Division conducts periodic investigative sweeps to identify and address widespread privacy violations, focusing on high-risk sectors and systemic issues across specific industries, businesses, or practices. In 2024, the Enforcement Division conducted the following enforcement sweeps: 

• Connected vehicle (CV) privacy practices: During 2024, the CPPA continued its 2023 efforts to review data privacy practices by CV manufacturers and related CV technologies because of the vast amounts of personal information collected from CV features such as location sharing, web-based entertainment, smartphone integration, and cameras.  
• Data broker registration: In October 2024, the Enforcement Division launched an investigative sweep targeting data brokers’ compliance with the registration requirements under the Delete Act.  The Enforcement Division brought multiple actions against noncompliant data brokers in 2024, further demonstrating the requirement for data brokers to register with the CPPA. Under the Delete Act, the CPPA has the authority to impose an administrative fine of $200 per day for each day a data broker fails to register, an amount equal to the fees due during the period the data broker failed to register, and any fees related to an administrative action brought by the CPPA.

Notably, the California Attorney General’s (AG) Office also conducted an investigative sweep in January 2024 to inspect the compliance of streaming apps, services, and devices for alleged failures to comply with the California Consumer Privacy Act’s (CCPA) provisions concerning opt-out mechanisms when selling or sharing personal information. According to the California AG, businesses that sell or share consumer personal information must offer “an easy mechanism for consumers who want to stop the sale of their data.”

CPPA’s first enforcement advisories

The Enforcement Division issued its first two enforcement advisories in connection with the CCPA: 

• Applying data minimization to consumer requests: The Enforcement Division observed that certain businesses ask consumers to provide “excessive and unnecessary” personal information, and the advisory reminds businesses to apply data minimization principles to each purpose for which businesses collect, use, retain, and share consumers’ personal information.
• Avoiding dark patterns: Clear and understandable language, symmetry in choice: The advisory reminds businesses to carefully review and assess their user interfaces to ensure they offer symmetrical choices (including via service providers and consent management platforms) and easy-to-understand language when offering privacy choices. User interfaces or choice architectures that have the “substantial effect of subverting or impairing a consumer’s autonomy, decision-making, or choice” are “dark patterns” and prohibited under the CCPA.

These advisories do not interpret the CCPA, but they highlight issues observed by the Enforcement Division and further put all businesses subject to the CCPA on notice as to areas that are particularly concerning to the Enforcement Division.

Rise in consumer complaints in 2024

Since 2023, the number of consumer complaints received by the Enforcement Division has steadily increased. By the end of 2024, the Enforcement Division received nearly 3,000 consumer complaints, which primarily concerned (i) the right to opt-out of sale or sharing; (ii) collection, use, storing, or sharing of personal information; or (iii) the right to delete.

Continued cooperation and partnership with federal and international regulators

The CPPA continues to collaborate with regulators across the world and, in June 2024, the CPPA entered into a declaration of cooperation with the French data protection authority, Commission nationale de l’informatique et des libertés. The CPPA’s Enforcement Division also participated in the 2024 Global Privacy Enforcement Network’s enforcement sweep examining websites and mobile apps for deceptive design.

In the United States, the CPPA (along with 10 state AGs) agreed to partner with the U.S. Federal Communications Commission’s Privacy and Data Protection Task Force to investigate, and where appropriate, prosecute or otherwise take enforcement actions related to privacy, security, and data protection. 

Reed Smith’s privacy and data security teams will continue to monitor the regulatory and enforcement activity in this space.