The Lawfare Podcast · The Lawfare Institute

Lawfare Daily: CPPA’s Tom Kemp on Data Brokers, Privacy, and State Enforcement

March 25, 2026·51 min·5 clips

52 data brokers sell to the federal government, and 31 sell to Gen AI developers, according to California's registry.

Host Justin Brookman interviews Tom Kemp, executive director of the California Privacy Protection Agency (CalPrivacy), about the agency's structure, the new DROP system, data broker transparency, and enforcement priorities. Kemp begins by outlining CalPrivacy's six mission areas: rulemaking, public awareness, auditing, enforcement, policy and legislation work, and administration of the Delete Act. He notes CalPrivacy is the nation's only independent agency focused solely on privacy, and that California was the first state with a comprehensive privacy law, with about 20 other states now following. The core of the episode covers the DROP system, created under the Delete Act (SB 362). Previously, consumers wanting to exercise deletion rights against data brokers faced what could amount to 10 full working days of individual requests across 500 entities. DROP reduces this to a six-to-seven-minute process: consumers verify California residency, enter basic personal information such as date of birth, zip code, email, phone number, or mobile advertising IDs, and submit. The data gets hashed and matched against data broker databases. Starting August 1, 2026, data brokers must check the hashed lists every 45 days, delete matches, maintain suppression lists, and report statuses back. Over 256,000 Californians have already signed up before deletions even begin. Kemp describes the updated data broker registry, expanded under SB 361 with 12-15 additional required data points. The registry now shows that 110 data brokers collect precise geolocation, 68 collect gender identity information, 52 sell data to the federal government, 31 sell to generative AI developers, and 33 sell to foreign actors. The registry grew from roughly 450 to over 580 registered data brokers under the agency's data broker strike force. On hiring technologists, Kemp explains that in-house product managers, software developers, and PhD computer scientists were essential for building DROP and are now central to enforcement and auditing. He notes the current job market has made strong technical talent available, partly due to federal agency downsizing at the FTC and CFPB. Kemp details enforcement actions including million-dollar-plus fines against Ford and Honda for privacy violations, a settlement requiring a company to hire a UX designer to fix its privacy rights interface, and actions against data brokers including Data Masters (which sold lists of Alzheimer's patients and agreed to exit California) and another that advertised selling "scary information about people" and shut down entirely. The agency is conducting joint enforcement sweeps with attorneys general from Connecticut and Colorado on Global Privacy Control compliance, and participating with 30-plus international authorities examining children's apps. CalPrivacy receives over 150 consumer complaints per week and has more than 100 open investigations. Looking ahead, Kemp identifies wearables collecting biometric and neural data as a growing risk area, and notes that California's new regulations on automated decision-making technologies take effect January 1, 2027, giving consumers rights to know about, opt out of, and object to critical automated decisions.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from The Lawfare Podcast