The CCPA, signed into law on June 28, 2018, and effective from January 1, 2020, marked a pioneering step in U.S. privacy legislation. It granted residents rights to access, delete, and opt out of the sale of their personal information held by businesses. The legislation emerged from a ballot initiative led by Alastair Mactaggart, a privacy advocate and real estate developer, who mobilized public support to address the growing influence of technology companies over personal data. Facing this citizen-driven effort, the California Legislature negotiated and enacted the CCPA to preempt a potentially more stringent voter-approved measure. Initial enforcement rested with the California Attorney General.

The CPRA, formally Proposition 24, was approved by California voters on November 3, 2020, with 56.2% support and became effective on January 1, 2023, with enforcement commencing July 1, 2023. Authored and championed again by Mactaggart through his organization, Californians for Consumer Privacy, the CPRA strengthened and expanded the CCPA. Motivated by high-profile data breaches and inspired by the European Union’s General Data Protection Regulation (GDPR), Mactaggart gathered over 629,000 signatures to place the measure on the ballot, bypassing traditional legislative channels. The CPRA introduced enhanced protections, including the right to correct inaccurate data and limit the use of sensitive personal information, while establishing the CPPA as a dedicated enforcement body. The CPPA, created under the CPRA, is the nation’s first agency solely dedicated to privacy regulation. Operational since late 2020, it assumed rulemaking authority from the Attorney General in April 2022. Governed by a five-member board—appointed by the Governor, Attorney General, Senate Rules Committee, and Assembly Speaker—the CPPA is tasked with enforcing privacy laws, issuing regulations, and educating the public. Mactaggart’s appointment to the board in October 2022 by Attorney General Rob Bonta underscores his enduring influence.