And so do you mind expanding on what this looks like and why it's done on a state level? Yeah, just overall the origin and how it compares to other things that exist right now.

Yeah, sure.

So, I mean, at the federal level, there are privacy laws, but they're very focused on a given sector of the economy.

So you have HIPAA that has protections for health information.

There is some protections in Gramm-Leach-Bliley as it relates to financial information.

But those laws were passed 25, 30 years ago.

And obviously, Europe, as you said, was the first with GDPR.

It's just I think it's important to ask because I know there's an association.

The other question I'm getting is people are wondering this, this MAID These, these identifiers for your phone or your TV, can you explain what those are, and do I have to submit those?

We ask for some really basic information.

We ask for your name or variations of your name, your, uh, date of birth.

We ask for your zip code or even past zip codes.

Now, then from there, you can put in your email address, or if you have multiple email addresses and phone numbers.

And then because there's these data brokers that specifically track our location because they have integration hooks into a lot of these free apps, and so what we're seeing is, is especially at the federal government level, they're buying geolocation information about all Americans, okay? And the way that they get this geolocation is that there's a mobile advertising ID, or MAID, that's associated with your phone.

And so if you optionally wanna add that as part of your little, tiny profile that you give us, you can do that.

It's all linked to me somehow in, in some cloud somewhere?

Um, so we, we've been kind of building up to this, to the, the drop platform, but can you walk us through what using drop actually looks like from a consumer's perspective?

Absolutely.

So the first step is go to privacy.ca.gov. And I want to be very clear, this is a free service available to Californians.

There was no taxpayer dollars involved in this.

The system itself is built utilizing the registration fees paid by the 600 plus data brokers that we have in the system.

And so once you go to privacy.ca.gov, The first step is to verify that you're a California resident.

You can verify using some basic personal information, or you can leverage your login.gov account.

How is the agency thinking about AI when it comes to privacy?

How would you feel about using or adapting an existing template just to make it practical for the organization? Or should they rather start from scratch and come up with something that's within the four squares of what is required in California?

California does not prescribe a single template or form for ADMT or other risk assessments, and that was intentional.

Businesses should be able to leverage existing compliance programs and internal infrastructure as long as they meet the requirements in our regulations.

The regulations were developed through extensive public input and are designed to balance strong consumer protections with practical business guidance.

Specific to ADMT assessments, businesses must evaluate whether technology is being used to make a significant decision about a consumer in the area of housing, education, healthcare, employment, loans, and identify relevant privacy risk and safeguards.

And the regulations do allow businesses to leverage, again, existing risk assessments such as the GDPR, DPIA, and supplement them as necessary to meet the CCPA's requirements.

Similarly, when it comes to cybersecurity audits in California, they must assess the security of the personal information across the business enterprises.

And we've already talked about consumers' rights and the ability to opt out, but is there one thing that you could highlight as your office's top priority at the moment?

What's better about the new technologies that are emerging in this area?

Yeah.

So you brought up, this is a favorite of mine.

I'm glad you brought this up.

So the California Consumer Privacy Act, or CCPA, does give consumers the right to opt out of the sale and sharing of their data.

And California is currently one of a dozen states that require businesses to honor requests made using oops.

And so what we have found, however, is trying to find An oops and an able to oops has been difficult for Californians.

Do you have any particular takeaway or message for people with perhaps a smaller California presence? What should they be prioritizing if they're serious about compliance and privacy but maybe don't have a huge budget? What would your message be to UK or European businesses if you have one?

What does a good one actually look like?

Well, certainly CalPrivacy does support a federal privacy law, but the one that we think would be best for not only businesses, but for consumers is one that sets a high floor That does allow states to innovate when it comes to providing additional protections for its citizens.

Unfortunately, what we've seen, especially this go around, is that this sets a low national ceiling on privacy rights.

And so our concerns are the following.

First is that this current proposal strips away rights that people already enjoy today.

For example, the opt-out preference signal, over 100 million Americans can take advantage of that.

And that's becomes a study, a three-year study.

How could you possibly think that we'd ever be able to comply with this patchwork?

So wanted to, uh, to hear your thoughts on that.

Yeah.

So when I joined as executive director, I think the number of registered data brokers was in the 400s, and y- you know, having worked on the Delete Act and knowing that the DROP system was going live, you know, I just made sure there was already some really good work happening in terms of enforcement, but, uh, you know, worked with our, uh, deputy director of enforcement, Michael Macco, and he formed a strike force to kind of double down on getting registrations.

And so I'm very pleased, in over a year we've gone from, you know, some number in the 400s, and now we have, uh, over 575 data brokers registered.

So we have significantly increased the number of registrations.

Now, up to now, and including actually through August, the enforcement for non-registration is $200 per day, and so a lot of the enforcement fines for non-registration have been in the 30, 40, 50, 60,000 area.

Now, we've done some injunctive relief.

Do you ever think that the pace of legislation can't keep up with technological innovation? I guess, does, does government regulation keep up with that right now? Because technology, it just seems to evolve at such a rapid pace that legislation struggles to meet that pace, and sometimes I wonder if the very nature of legislation, because it's inherently slower than the private sector, can ever actually keep up with innovations in the tech sector.

Like, why is that worth emphasizing about CalPrivacy?

Yeah, so I wasn't appointed by Governor Newsom.

The Prop 24 created a board, two of which are, including the chair, appointed by the governor, one by the AG, one by the speaker, and one by the Senate pro tem leader.

And so it's an independent board.

They meet quarterly and they appoint an executive director that does the day-to-day operations and um and so you know so i don't have to report into uh i think probably if we were part of uh you know part of the california government and you know i'd probably be working for uh chopra chopra uh that was just put into to that role we would have been probably been one of the agencies that are now under him as part of the reorganization.

But we are independent, and that gives us some additional flexibility.

For example, one of the things that Prop 24 says that, well, you can do policy and legislation in terms of advising not only the California legislature but other jurisdictions, And we can also support as well as sponsor legislation.

Is it long live notice and choice?

Meanwhile, these data brokers are making tons and tons and tons of money off of our information.

It's a multi-hundred billion dollar-plus market, and as you mentioned before, we're their products.

We don't have a direct relationship with the entities.

They, they just create these ha- huge digital dossiers on each and every one of us, and they sell it to anyone with a credit card.

What's happening is that increasingly hackers find it easier just to buy the data from the data brokers, and then they specifically target, uh, each and every one of us.

So what we're seeing is increasingly our personal information is being weaponized against us.

Uh, our personal information is being used to do surveillance pricing.

You know, up until now, we felt like we had no agency, that we just are not in control of any of this, 'cause, yeah, nobody has the time or the energy to go individually after every single one of these brokers and say, "Leave me alone."

Uh, do you envision in the coming months any particular challenges for expanding it as well as opportunities for ways to, whether it's just broaden, uh, access and awareness of the system or to update it technically in any way?

Yeah.

I mean, obviously, we're, we're, uh, very much in the mode right now of evangelizing this and raising awareness to Californians.

And so, uh, if you are a listener and, uh, you are a California, please go to privacy.ca.gov. It's right there on the homepage, and you can click on it, and then again, it only takes you six, eight minutes to, you know, have this huge advantage of being able to take control over your personal information.

And then in terms of c- what's happening moving forward, the Delete Act was actually amended last year with, uh, SB three sixty-one, which was a bill also done by Senator Becker, and then prior to taking this, uh, position, I'd, I'd been at Cal Privacy as the executive director for a year.

I also recommended this to him as well, and this increased, uh, disclosure requirements for data brokers moving forward.

And so before the registry asked some basic information of the data brokers, and it asked for basically three bits of, uh, information that the data brokers have to provide, uh, whether or not they collect the data of, uh, children, whether or not they collect reproductive health, and whether or not they collect geolocation information.

So, you know, as you look ahead to twenty twenty-six or maybe even think about twenty twenty-seven, what are your top enforcement priorities? And for whatever you wanna call out, can you say more about what motivates your thinking and, and California's focus on those subjects?