California privacy enforcement in 2026: A discussion with CalPrivacy's Tom Kemp

The California Privacy Protection Agency was formed six years ago as mandated by the California Privacy Rights Act. As the first dedicated privacy regulator in the U.S., CalPrivacy - as it's called colloquially - implements and enforces both the CPRA and California Consumer Privacy Act. Under the state's Delete Act, it also oversees California's data broker registry and the Delete Request and Opt-Out Platform, known as DROP. Tom Kemp serves as executive director for CalPrivacy and is almost a year into his tenure after taking on the role in April 2025. On 1 January 2026, the DROP system went into effect and now boasts more than 215,000 registrants with more than 500 registed data brokers. The agency is also implementing a number of regulations in the state, including for automated-decision making, risk assessments and cybersecurity audits. IAPP Editorial Director Jedidiah Bracy caught up with Tom Kemp to learn more about the DROP system and the agency's priorities in the year to come.