US-CaliforniaWhat is the California Privacy Protection Agency?
The California Privacy Protection Agency (CPPA) is the first agency in the U.S. dedicated to enforcing consumer privacy laws, created by the California Privacy Rights Act (CPRA) to implement and enforce the CCPA and CPRA.
What the Law Says
The California Privacy Protection Agency was established by the California Privacy Rights Act (CPRA) to implement, enforce, and regulate the California Consumer Privacy Act (CCPA) and the CPRA itself.
The CPPA is an independent regulatory agency with full authority to enforce the CCPA and CPRA — including investigating violations, issuing regulations, imposing fines, and bringing civil actions in court.
It began full enforcement authority on July 1, 2023 — six months after the CPRA’s substantive provisions took effect. The agency is governed by a five-member board appointed by top California officials, including the Governor and legislative leaders.
Unlike the Attorney General’s office — which previously enforced the CCPA — the CPPA is solely focused on privacy and has dedicated expertise, rulemaking power, and investigative staff.
Statutory TextThere is hereby created the California Privacy Protection Agency… to implement and enforce the California Consumer Privacy Act… and the California Privacy Rights Act…
— Cal. Civ. Code § 1798.199.10 — Creation of the California Privacy Protection Agency
Statutory TextThe agency shall have full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act… and the California Privacy Rights Act…
— Cal. Civ. Code § 1798.199.40 — Powers and duties
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.