State Privacy Regulators Assemble: Attorney General Bonta Announces Bipartisan Consortium of Privacy Regulators

Continues commitment to protecting Californians' privacy rights 

OAKLAND — California Attorney General Rob Bonta today announced an agreement of formal collaboration between seven states and the California Privacy Protection Agency (CPPA) to promote collaboration and information sharing in the bipartisan effort to safeguard the privacy rights of consumers. Known as the Consortium of Privacy Regulators, the group regularly discusses developments in privacy law, shared priorities, and coordinates enforcement, as appropriate, based on the members’ common interest. In forming the Consortium of Privacy Regulators, Attorney General Bonta joins the CPPA and the attorneys general of Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon.

“Data knows no borders — state and nationwide coordination is vital for protecting consumers’ rights, especially in our data-driven world,” said Attorney General Bonta. “Collaborating with partners across the country provides another tool in the toolbox for my office to tackle enforcement priorities and continue safeguarding the privacy rights of Californians.”

Privacy matters because when information or data falls into the wrong hands, it can harm people, businesses, and organizations, often financially. The risk of harm continues to grow as more consumers conduct essential tasks online, like banking, shopping, or managing medical care. Businesses that collect this personal information also create the risk of data breaches when they fail to safeguard it. Lapses in upholding privacy laws can threaten to disclose information like our financial condition, health status, and sensitive aspects of our personal lives. Anyone can become vulnerable.  

California’s Landmark Privacy Law: The CCPA

The California Consumer Privacy Act (CCPA) secures increased privacy rights for California consumers, such as the right to know how businesses collect, share, and disclose their personal information. Businesses that are subject to the CCPA have specific responsibilities, including responding to consumer requests to exercise these rights and giving consumers certain notices explaining their privacy practices. Under the CCPA’s right to opt-out, businesses that sell personal data or share personal information for targeted advertising must permit consumers the right to opt-out. Exercising this right should be easy and involve minimal steps.

Our Recent Work to Protect Californians' Privacy 

Attorney General Bonta is committed to educating California consumers about their right to privacy and enforcing the nation’s toughest data privacy law.  

Last month, Attorney General Bonta issued a consumer alert to customers of 23andMe, reminding Californians of their right to direct the deletion of their genetic data under the Genetic Information Privacy Act (GIPA) and the CCPA. Also last month, Attorney General Bonta announced an ongoing investigative sweep into the location data industry, which collect and share detailed data on consumers’ location. The risk posed by the widespread collection and sale of location data has become particularly relevant given federal threats to California's immigrant communities, and to reproductive and gender-affirming healthcare. In January, Attorney General Bonta reminded Californians of their right to stop or "opt-out" of the sale and sharing of their personal information under the CCPA.

Attorney General Bonta has filed three enforcement actions involving alleged violations of the CCPA: 

• In 2022, he announced a settlement with Sephora resolving allegations that it failed to disclose to consumers that it was selling their personal information and failed to process opt-out requests via user-enabled global privacy controls in violation of the CCPA.
• In 2023, he secured a settlement with DoorDash after it sold the personal information of its customers without providing notice or the opportunity to opt-out.
• In 2024, he worked with local partners to secure a settlement with video game developer Tilting Point Media for violating state and federal privacy laws by illegally collecting and sharing children's data.   

For more information about the CCPA, visit www.oag.ca.gov/ccpa. To report a violation of the CCPA to the Attorney General, consumers can submit a complaint online at www.oag.ca.gov/report.