The Lawfare Podcast Lawfare Daily: CPPA’s Tom Kemp on Data Brokers, Privacy, and State Enforcement
Mar 25, 2026
Tom Kemp, Executive Director of the California Privacy Protection Agency, leads implementation of California’s privacy laws. He explains the DROP system for delete and opt-out requests and the data broker registry. The conversation covers technologists in regulation, interstate cooperation on privacy enforcement, concerns about foreign access to U.S. data, and emerging risks from wearables and automated decision rules.
AI Snips
Chapters
Transcript
Episode notes
How DROP Enables Scale Deletions
- DROP lets Californians submit limited identifiers (DOB/zip, email, phone, MAID) and stores hashed lists for data broker matching.
- Data brokers will download hashed lists, match via the same hashing, and must delete matches and maintain suppression lists.
Sign Up For DROP To Reclaim Your Data
- Californians should sign up at privacy.ca.gov to submit minimal identifying data and control sale/deletion of their personal information.
- The process takes about six to eight minutes and allows updates, status checks, and future suppression.
Expanded Registry Data Reveals Broker Practices
- SB 361 expanded required registry disclosures with ~12–15 new data points including immigration status, union membership, sales to government, and unique identifiers.
- That registry data will inform platform matching fields and consumer education (e.g., MAID collection prevalence).