California’s privacy agency spent its first two years building rules and its next two proving it will use them. The pattern in its orders is procedural cruelty to consumers: opt-outs that silently fail, verification that demands more data than the request needs, cookie banners with asymmetric effort. The agency has said plainly that it charges what it can see, and what it can see is your public-facing rights machinery.
| Regulator | CPPA (+ California AG in parallel) |
|---|---|
| Orders to date | Honda $632,500; Todd Snyder $345,495; Delete Act sweep fines |
| Stated priorities | Dark patterns, data brokers, connected vehicles, children, ADMT |
| Next wave | Risk assessments, cyber audits, ADMT rights (2025 regs, phased) |
Reading the priorities operationally
Rights machinery is the audit surface. Every order so far began with a testable consumer experience. Self-audit quarterly: submit a DSAR, click the opt-out, send a GPC signal from a clean profile, and verify tags actually stop firing. The CCPA checklist sequences this.
CMP misconfiguration is a business violation. Todd Snyder establishes that “the vendor broke it” is not a defense. Contract for validation rights with your CMP, log signal propagation, and alert on opt-out volumes dropping to zero (the telltale of a broken pipe).
Data brokers have a dedicated regime. Registration (with per-day late fines), disclosure duties, and from 2026 the Delete Act’s DROP deletion mechanism, which the CPPA has signaled it will enforce aggressively. If you sell data about consumers with whom you lack a direct relationship, check the registration guide now.
ADMT turns AI governance into privacy compliance. Pre-use notices, opt-outs for significant decisions, and risk assessments that name model purposes and safeguards. Companies deploying hiring screens, credit models, or behavioral profiling should stand up the assessment templates before the phase-in dates arrive; the risk assessment guide maps the requirements.
Watch the sweeps. Connected vehicles, streaming apps, and children’s services have received inquiry letters; sweeps become orders when responses reveal the gaps above. If you operate in a swept sector, treat the public inquiries as your exam syllabus.
The CPPA finds most of its cases on the open web. See your site the way its investigators do: run a free scan and fix what it surfaces before they ask.