The head of the California Privacy Protection Agency on the future of data privacy regulation

Recorded Future News interviews CPPA head Tom Kemp on California’s evolving privacy and cybersecurity agenda, emphasizing the risks posed by data brokers and the forthcoming Delete Act portal that will let consumers request mass data deletion, backed by fines starting August 2026. Kemp contrasts public records access with large-scale broker dossiers, notes potential legislative additions like whistleblower protections and protections for officials’ data, and discusses federal preemption risks. He highlights proposed cybersecurity audit rules aligned with NIST and CIS, and addresses criticism of narrowed automated decision-making rules, arguing the package—covering risk assessments, ADMT, and cybersecurity—strikes a balance through public comment while remaining among the most robust in the U.S.