Episode 64: Tom Kemp of CalPrivacy discusses the DROP & Public Policy Goals

Summary

The Monopoly Report – Episode 64

Guest: Tom Kemp, Executive Director, Cal Privacy
Host: Alan Chappell
Date: February 4, 2026
Title: Tom Kemp of CalPrivacy Discusses the DROP & Public Policy Goals

---

Episode Overview

This episode delves into the latest developments in privacy regulation in California, focusing on the newly launched DROP (Delete Request and Opt-Out Platform) mechanism and the broader policy ambitions of Cal Privacy. Host Alan Chappell, an industry attorney and regulatory expert, sits down with Tom Kemp, Executive Director of Cal Privacy, for a thorough discussion on the agency's role, vision, and approach to balancing consumer rights, regulatory enforcement, business obligations, and innovation. Listeners get deep insights into enforcement philosophy, the practicalities of the DROP system, evolving policy trends, and the cross-jurisdictional future of data privacy.

---

Key Discussion Points & Insights

1. Cal Privacy—Mission and Mandate

[04:47]

• Cal Privacy is the nation’s only independent agency solely dedicated to consumer privacy, created by California’s Proposition 24 (the California Privacy Rights Act, CPRA) in 2020.
• The agency’s unique powers span regulation, enforcement, public policy, and legislation, not just traditional compliance and oversight.
• Tom Kemp was appointed by an independent board and emphasizes the agency's operational autonomy:

  "I am not a political appointee. I was appointed by a board... So that's how we're set up. And that's what I do on a day to day basis." (Tom Kemp, 06:54)

---

2. Tom Kemp’s Journey and Vision for Cal Privacy

[07:25]

• Kemp's background in tech entrepreneurship and cybersecurity positioned him to lead Cal Privacy, having previously contributed to Proposition 24 and the Delete Act.
• Personal motivation also drives his work: making privacy “easy at scale,” reducing friction for consumers, and translating policy ideas into real-world impact.
• On his move into public service:

  "It was also an opportunity to actually talk the talk, but walk the walk and have things that I care about be able to be implemented." (Tom Kemp, 09:36)

---

3. The DROP System: California’s Delete Request & Opt-Out Platform

What is DROP?
[11:46–15:08]

• DROP is a free online tool (privacy.ca.gov/drop) launched Jan 1, 2026, for Californians to request deletion of their personal data from data brokers en masse.
• Inspired by proposals at the federal level and Tim Cook’s 2019 call for a “data broker clearinghouse.”
• It's the first of its kind globally:

  "It makes it very easy for Californians to be able to exercise their privacy rights at scale and better protect their personal information." (Tom Kemp, 12:47)

• Over 200,000 Californians signed up in the first month—all organic, with no paid marketing.
• Funded by data broker registration fees, not taxpayer dollars.

How It Works
[13:55, 15:08]

• Users verify their residency, enter basic info, which is securely stored.
• Starting in August, registered data brokers must check the DROP system, match entries, and delete data where applicable.
• The system supports iterative updates (new emails, vehicles, etc.) and provides status feedback and a complaint loop for consumers.

"This is kind of one of the first steps that we're trying to do to enable privacy at scale and kind of tip the balance back to consumers..." (Tom Kemp, 18:56)

---

4. Early Reception and Potential for Replication

[17:11, 20:35]

• The system is getting strong “word of mouth” traction—even among the non-techie public.

• At least ten other states have expressed interest in adopting similar mechanisms, across the political spectrum (blue and red states listed).

• Inter-state cooperation is encouraged by Prop 24’s mandate, and Cal Privacy is open to technical and policy collaboration.

  "We are certainly interested in discussing with other states how we can help them to implement a Delete Act-type style system like our DROP system." (Tom Kemp, 21:36)

• The agency is considering all options: offering high-level guidance, technology sharing, or even adding other states to the platform—subject to independent board approval.

---

5. Enforcement Approach and Defining Harms

[25:45, 27:05, 29:14]

• Recent enforcement focused on sensitive information (such as lists of people with Alzheimer’s sold by data brokers)—leading to companies exiting the CA market.

• With ad tech specifically (excluding health, location, kids, elderly), Cal Privacy focuses on removing roadblocks for consumers exercising their rights, rather than targeting ill-defined privacy "harms":

  “…what we’ve been doing from an enforcement perspective is really just trying to make sure that it’s easy for consumers to be able to exercise their privacy rights.” (Tom Kemp, 27:39)

• Enforcement is “measured and fair,” setting expectations via advisories, sweeps, and public clarity—not arbitrary “raining lightning bolts.”

---

6. The Role and Future of Authorized Agents, DROP, and OOPS (Opt-Out Preference Signals)

[32:35–38:01]

• Authorized agents are baked into the law, enabling consumers to delegate privacy rights (valuable for elderly, officials, etc.).
• DROP and OOPS (‘Opt-Out Preference Signals’) like GPC (Global Privacy Control) are raising the floor of privacy protections by making mass requests easier.
• Kemp envisions a future where AI agents could automate rights-exercising on behalf of consumers.
• Recognizes some market commoditization but sees a continued role for authorized agents, especially as technologies and user needs evolve.

  “It’s not that just doing DROP and GPC is the end all or be all... But I still think there’s a lot of headroom out there.” (Tom Kemp, 37:43)

---

7. Browser Preferencing, GPC, and Future Regulations

[38:01–40:55]

• Cal Privacy is open to regulations addressing "anti-preferencing"—ensuring browsers like Apple’s don’t treat their own ad services differently from competitors:

  "I don't want to comment on that because that's something... we're going to go out and get public comment and feedback on it as well. We know that people have already brought that to our attention." (Tom Kemp, 39:22)

• The upcoming rulemaking will invite public input, with specifics expected after the February board meeting.

---

8. Regulation of Authorized Agents—Need for Transparency

[41:00–44:47]

• The agency is aware of bad practices—agents bombarding companies with requests or misrepresenting the law.

• Cal Privacy’s existing regulations already touch on agents, but further changes may come—especially regarding transparency and operational burdens.

  "Is there additional things that we have to do as it relates to authorized agents? So it's on the table and we look forward to investigating this as well." (Tom Kemp, 43:49)

• Chappell pushes for a baseline transparency requirement: "there is currently no requirement that they list the data brokers that they are protecting one from. And that seems like a baseline transparency requirement, no?" (44:30)

---

9. Defining the Data Broker Boundaries and Enforcement

[45:30–49:17]

• Who is a "data broker"? Cal Privacy uses statutory and regulatory definitions, with recent advisories clarifying "direct relationship".
• Retailers supplementing first-party data with purchased third-party data and then selling that data may trigger data broker classification.
• Enforcement will apply whether or not an entity has registered—unregistered data brokers face $200/day/record fines starting August.

---

10. Notable Quotes & Sound Bites

• On Privacy Rights Demand:
  “When people say that consumers really don’t want privacy, well, I think this is a great data point to show that there’s overwhelming interest in having laws that give people better control over their personal information.” (Tom Kemp, 05:23)
• On Making Privacy Easy:
  “If you do make it easy, people will exercise [privacy rights]. And you saw that with Prop 24...and now you can also see that with initial deployment metrics associated with the DROP system.” (Tom Kemp, 19:21)
• On Enforcement Approach:
  “We’re trying to set expectations... we certainly don’t want to....just start raining lightning bolts randomly on the marketplace.” (Tom Kemp, 30:54)
• On Transparency:
  "We want to make our privacy not only easy for consumers, but we want to make it as easy as possible for businesses." (Tom Kemp, 53:57)

---

Timestamps for Important Segments

• [04:47] – What is Cal Privacy and Tom's Role
• [07:25] – Why Tom Kemp took the job; vision for the agency
• [11:46] – Introduction to the DROP system
• [13:55] – How DROP works practically
• [20:35] – Interest from other states in California’s privacy approach
• [25:45] – Shifting awareness of privacy harms and enforcement focus
• [27:39] – Enforcement actions: making privacy rights practical
• [32:35] – The role of authorized agents vs. DROP/OOPS
• [38:01] – Browser-based global privacy control (GPC) and potential anti-preferencing rules
• [41:00] – Regulation and transparency of authorized agents
• [45:30] – Who counts as a data broker?
• [49:17] – Specific examples: when do retailers (and others) qualify as brokers?
• [53:57] – Agency philosophy: ease for both consumers and businesses

---

Host Analysis & Final Takeaways

[55:26–59:30]

• Chappell notes Cal Privacy’s measured and fair enforcement.
• He calls for clearer focus on concrete privacy harms—beyond mere process and compliance.
• Warns of anti-competitive risks in browser implementation, especially in light of how players like Apple have built massive ad businesses post-ATT.
• Advocates for more transparent regulation of authorized agents; the current framework, while legally mandated, is not always functioning well in practice.
• Praises DROP's innovation and early success, but urges the agency to focus on real-world outcomes over regulatory process as it matures.

---

Resources

• privacy.ca.gov/drop – California's DROP System
• Cal Privacy Home
• [Show notes and additional resources] (referenced by Alan Chappell)

---

Tone:
The discussion is collegial, candid, and thorough, with both host and guest keeping the conversation technical and policy-focused but approachable to industry and privacy stakeholders.

For More:
Subscribe to the podcast at monopolyreportpod.com or on your favorite platforms.

Transcript

[Host - Market Live Announcer]

Market Live is coming up March 10th and 11th in New York City. With us some just some of the brands and agencies that have registered thus far. And don't worry, we'll be doing several of these announcements with us Bayer, BMO, Farmers Insurance, Electronic Arts, the Hershey Company, HP Huntington Bank, JPMorgan Chase, Kenview, L', Oreal, Mastercard, NFL, PayPal, PepsiCo, Redfin, Synchrony, T Mobile, Verizon, Workday Ah, agencies. Want to hear which agencies are going.

[Tom Kemp]

To be joining us?

[Host - Market Live Announcer]

Assembly, Butler, Till, Canvas Worldwide, Kara Choreograph, Kridera, Dentsu, Digitas, ipg, IPG Media Brands, Magnet, omd, PMG Publisher, Sapien, Razorfish, Wavemaker, WPP Media and more. Can't wait to see you there. Go register now. Marketecturelive.com 3-10-11.

[Audiohook Sponsor Voice]

This podcast is brought to you by Audiohook, the leading independent audio DSP. Audiohook has direct publisher integrations into all major podcast and streaming radio platforms, providing 40% more inventory than what could be accessed in omnichannel DSPs. What's more, audiobook has full transcripts on more than 90% of all podcast inventory, enabling advanced contextual targeting and brand suitability. Audio Hook is so confident that in addition to CPM buys, they offer for the industry's only pay for performance option, where brands can scale audio and podcasting with peace of mind, knowing they are only paying for outcomes. Visit audiohook.com to learn more. That's audiohook.com.

[Alan Chappelle]

Welcome to the Monopoly Report the Monopoly Report is dedicated to chronicling and analyzing the impact of antitrust, privacy and other regulations on the global advertising economy. I'm Alan Chappelle. I'm a privacy and regulatory attorney and have worked with hundreds of digital media and ad tech companies over the years. I also publish a monthly Strategic Outlook report for digital media worldwide called the Chappelle Regulatory Insider. You can find a link to a sample copy of the Chappelle Regulatory Insider in the Show Notes this week, my guest is Tom Kemp, the Executive Director of Cal Privacy, California's privacy enforcement agency. Previously, Tom was the founder and CEO of Centrif. Tom has served as a Technology Policy Advisor for marketing efforts in 2020 to pass California Proposition 24, which is the California Privacy Rights act, and advising and.

[Podcast Host / Interviewer]

Contributing to the passage of state privacy.

[Alan Chappelle]

Laws in 2023, such as the California SB362, which is the California Delete act, and TE SB 2105. I'll place Tom's complete bio in the show Notes. I will say that I was skeptical that California would be able to find someone to fill the very large shoes of Ashkan Sultani, who was the first CPPA executive director. But Tom was a fantastic hire and has to date, filled those shoes quite capably. I know that Tom wants to talk about California's newly launched drop deletion mechanism and, and the privacy rights that the CCPA and the Delete act provide to California data subjects. I am hoping to engage in a broader public policy discussion with Tom. There has certainly been a lot of activity taking place in California on privacy. I want to uplevel the discussion a bit and get a better sense of the larger goals of Cal Privacy. There's lots of focus on the data broker and ad tech communities in California. I'm trying to understand how that focus and that activity are tethered to specific policy goals. So let's get to it.

[Podcast Host / Interviewer]

Hey, Tom, thanks for coming on the pod. How are you?

[Tom Kemp]

I'm doing great. Thanks for having me.

[Podcast Host / Interviewer]

Well, where do we find you today?

[Tom Kemp]

I'm in the Bay Area, the Palo Alto, Menlo park area.

[Podcast Host / Interviewer]

Wonderful, wonderful. I spent a lot of time out in Sausalito and so big, big fan of the, the overall area and particularly this time in January because I think it is exactly 3 1/2 degrees here.

[Alan Chappelle]

In New York City today.

[Tom Kemp]

We've been getting some good weather here. We've been in the low 60s, so we understand that our colleagues on the east coast are freezing. So.

[Podcast Host / Interviewer]

So my dad had a college friend and they were in a jazz band together and they. Every year they would have a beginning and end of how are we going to survive the harsh California winter party? And they had it free for years and years. Whole bunch of jazz musicians would show up. It was always a good time.

[Tom Kemp]

It sounds like fun.

[Podcast Host / Interviewer]

So briefly, just to set the table here, what is Cal Privacy and what is your role within Cal Privacy?

[Tom Kemp]

Yeah, absolutely. Cal Privacy is the nation's first and only independent agency dedicated solely to consumer privacy. It was created with the passage of Prophecy 24 in 2020, the California Privacy Rights act that amended the CCPA. Now, I'm going to point out that 9.3 million people voted for that particular proposition. That's actually more than Kamala Harris got in the last election. And it is greater than the population, I think, of about 10 states in the United States. So when people say that consumers really don't want privacy, well, I think this is a great data point to show that there's overwhelming interest in having laws that give people better control over their personal information. And so this gives us as an independent agency responsibility in four areas. Regulation, enforcement. And in the case of enforcement, we share that with the California Attorney General. It gives us the ability to do policy and legislation, including sponsoring bills and public affairs. So it's kind of unique in that most regulators of privacy kind of focus more on the enforcement and regulation. But we can do public affairs, we can do policy, we can sponsor legislation. And then in 2023 we were given a fifth capability which is through the passage of SB362, the California delete Act. We're responsible for this accessible deletion mechanism. And then overall I'm the Executive director, so I do the day to day operations. I was appoint by an independent board, so I was not appointed by the Governor. Oftentimes when at cocktail parties people start complaining to me about different things having to do with California, although they don't complain about the drop system. So. But no, I am not a political appointee. I was appointed by a board. Two members are actually appointed by the Governor, one from the Attorney General, one from the Senate Pro Tem Leader and one from the Speaker. So that's how we're set up. And that's what I do on a day to day basis.

[Podcast Host / Interviewer]

Okay, well I'm curious, what were your top reasons for taking the job and then what was it like to transition from an investor, author and at sometimes big tech critic into leading the biggest.

[Alan Chappelle]

States privacy regulatory agency?

[Tom Kemp]

Well, I've historically here in Silicon Valley been an entrepreneur and co founded a company that went public. And then my last company, I was the founder and CEO of a cybersecurity company. So I've been in the Valley, definitely understand technology, understand the usage of personal information historically more so from a cybersecurity perspective. And in 2020 I was a full time volunteer on Proposition 24. It was a very small campaign, there was like three or four of us and in effect I was the Chief Marketing Officer of the campaign. So I really believe in the mission of the California Privacy Protection Agency that was created. I'm going to call it Cal Privacy Moving forward, that's the new consumer friendly nickname. But our legal name is still the cppa. But I saw the great potential of this agency and so when this opportunity became available I really felt I could add some unique things to the agency. Having been CEO of a company and managed over 500 people, having worked on legislation such as the California Delete act with Senator Becker, and also proposed and worked with him on this AI Transparency act that passed in 2024 and then also just my overall expertise in cybersecurity and privacy. So I felt it would be a good fit. And then the last reason is in 2023, I wrote an article for Tech Policy Press called let's Make Privacy Easy. And I called for a number of things that I thought would be really good to enable privacy at scale and reduce friction. And so this was actually a great opportunity that if you write something to be able to actually implement that vision and carry that vision over. And I'm very proud that the majority of the things that I wrote that we were able to accomplish in the last year, including successful launch of the Delete request and opt out platform, getting the California Opt Me out act passed, as well as additional things that we're doing to help reduce friction for consumers being able to exercise their privacy. So it was also an opportunity to actually talk the talk, but walk the walk and have things that I care about be able to be implemented.

[Podcast Host / Interviewer]

Well, I'd love to post the article in the show Notes and also I would love to know of the topics that you talked about in the article, is there anything in there that you still sort of on your list?

[Tom Kemp]

The answer is yes, but we're actually addressing that right now via both policy in the form of regulations as well as proposed legislation. So of the article, it was having for third party data an accessible deletion mechanism which is the drop system. The second focus area in the article was to have the ability to have opt out preference signals for first party data to enable do not sell shares. The third area was reducing friction for consumers. And what we're doing now is actually going to come out with and gather feedback on regulations to do exactly that. Are there additional things that we can do with consumers to not only enable operationalizing privacy rights, but also make it easier for businesses at the same time to respond to requests from consumers as well? Furthermore, today we, with Senator Becker, we're announcing a new bill called the Expanding Privacy Rights act where we further enhance the ability for consumers to make privacy requests as well as expanding the deletion rights that consumers have with first party interactions. And we can talk a little bit more about that bill maybe later, but yes, so have really kind of hit two of the three and then the third one is in process both with regulations and legislation.

[Podcast Host / Interviewer]

Well, fantastic. You guys have certainly been pretty busy to say the least. I wanted to talk a little bit about the drop mechanism, so I want to give it its full name. With the delete request and opt out platform going to go with drop from.

[Alan Chappelle]

Here on in, but it went live on January 1st.

[Podcast Host / Interviewer]

And so what is the drop?

[Alan Chappelle]

You sort of alluded to it, but.

[Podcast Host / Interviewer]

What does it do? How has the initial rollout performed and what has the early adoption been?

[Tom Kemp]

Yeah, so the drop system is a free online tool developed by Cal Privacy. We partnered with the California Department of technology, or CDT, to help build that. And it launched January 1st of this year. It was required by the California Delivery Lead act, which was SB 362, authored by Senator Becker and signed into law by Governor Gavin Newsom in 2023. Now, I want to be very clear, this is not an original idea. Senator Wyden had some proposals, you know, five, six, seven years ago. Tim Cook, the CEO of Apple, wrote a editorial in Time magazine in 2019 calling for a data broker clearinghouse. And then there has been a federal proposal by Senator Cassidy, obviously a Republican, Senator Ossoff, a Democrat, called the Delete act, which is the federal version. And in 2022, I talked to Senator Becker about this. I proposed this to him and he loved the idea and he proposed it. And it's really the world's first platform of its kind. It makes it very easy for Californians to be able to exercise their privacy rights at scale and better protect their personal information. And so what Californians do is they go to this website on privacy.ca.gov drop they verify their residency, put some basic information in, and then that information is immediately stored in a secure manner. And then starting in August, data brokers that have registered with the state, and as of December 31, there was over 545 data brokers that register will have to consult the system and then actually hash their own information. And then if there's any matches, then they're going to have to delete and create a suppression list for if they subsequently get the information as well. And so late breaking news here, besides telling you about today's announcement about the expanding Privacy Rights act that's being announced in an hour from when we're recording this. So probably by the time this gets published, it will be publicly out. But the other late breaking news that you'll be the first to know is that we've hit over 200,000 Californians that have signed up for the drop system. That's pretty amazing because it's only launched in just what, 28, 30 days ago. So we're now seeing over 50,000 Californians a week sign up for the system. And I think that really, again, just like Prop 24, overwhelmingly pass, this is a great data point that Californians or just consumers in general want more privacy protections. And so we're very grateful and gratified. And I should point out that this was fully funded through data broker registrations to access fees. This is not taxpayer dollars paying for this. So it's a free service that people could take advantage of. It doesn't really kick in until the fall when the deletions occur. But even with that, people are signing up in droves.

[Podcast Host / Interviewer]

Do you have a guesstimate for what percentage of the California population you think is going to ultimately sign up for this?

[Tom Kemp]

I do have some internal guesstimates, but we're not actually publishing those as well. And the interesting thing is, is that we haven't done any marketing per se for this. This has all been organic. And we also kind of felt that because the deletions would not occur until the fall when. And that's per statute, and I'm perfectly fine with that. We fully need to get the data brokers to register. The registration ends January 31st. We are going to make available the API this spring and have people test things out. So there should be a lag between when people can sign up and when the deletions occur. So we want to make sure data brokers are all in line and able to successfully test things out before using that. But it was pretty amazing frankly, to see that even though the deletions won't occur for seven, eight, nine months down the road, that people still just want to get in line, still want to use the system, et cetera. And one last thing I'll bring up about the drop system. It's a living, breathing system that if consumers add a phone number, an email address, they figure out what their mate is or they want to add, they get a new car, add a vin, they can go back and add that stuff. And then similarly, when the deletion process begins, they can go back and consult the system and see what the status of the deletions and what data brokers have deleted their information. What data broker said, oh, this data is exempt. What data brokers have said, no match. And inside the system, if they're not happy, and if they think that a data broker says that they haven't deleted, but they have some evidence that the data actually is still out there, they can file a complaint directly with us inside the system as well. So it's a nice closed loop system that Californians can come back to to enhance their information, check their status, and if they have an issue that they can raise a complaint with us.

[Podcast Host / Interviewer]

Well, for what it's worth, what I'm hearing from friends in California, and I'm going to exclude, you know, my tech friends and, and my, my legal friends, my lawyer friends. There seems to be a fair amount of buzz, if that's really the right word here, amongst people who I would not necessarily have expected to know about this.

[Alan Chappelle]

So it's going to be really interesting.

[Podcast Host / Interviewer]

To see ultimately what the adoption is.

[Alan Chappelle]

Because it's still early.

[Podcast Host / Interviewer]

But it does seem like the initial.

[Alan Chappelle]

Signs point to something that's pretty robust.

[Tom Kemp]

Yeah. What we've heard from journalists and people in media that when they've posted articles or interviews on this topic, that this is one of the more popular pieces of content that they posted. And so I think that there's just a lot of desire and a lot of frustration out there. You know, we always talk about the privacy paradox, and the privacy paradox is, is that people talk the talk about privacy, but they don't walk the walk as it relates to actually exercising their privacy. My thesis, which goes back to that article I talked about, let's make privacy easy, is that it's just the reason why there hasn't been greater adoption of and usage of privacy tools is that they've been too tough, they've been too hard. Right. And it's very difficult to enable that in scale. I mean, compare the alternative of not having drop that you would have to reach out to 545 data brokers, spend 20, 30 minutes kind of going back and forth with each and every one. So multiply 30 minutes times 545, and it's not a permanent deletion. So 545 times what, 20, 30 minutes is what, 10 days of work to be able to submit requests. And so the nice thing is that this is kind of one of the first steps that we're trying to do to enable privacy at scale and kind of tip the balance back to consumers in terms of giving them the tools that they want. And so people do want tools, but you got to make it easy for them. And if you do make it easy, people will exercise. And you saw that with Prop 24, with 9.3 million votes. You saw that with the tracking, transparency, that there's very high adoption. I know you have a lot of thoughts on that ATT from Apple, but we all can agree that a lot of people have turned that on. And then now you can also see that with initial deployment metrics associated with the drop system here in California.

[Podcast Host / Interviewer]

Yeah, I'm not sure I would use ATT as the bastion of demonstrating how much consumers care about privacy. I think it has as much to do with, you know, consumers. If you scare them enough, they're going.

[Alan Chappelle]

To take a certain action.

[Tom Kemp]

Okay, then we'll throw that out. And it's just simply point to that. There was an opportunity in 2020 to enhance the California Consumer Privacy Act. People did vote overwhelmingly for that, 9.3 million voters. And as it relates to the drop system, we have seen, you know, overwhelming demand.

[Podcast Host / Interviewer]

You know, we talked about this a little bit before we jumped on. I mean, there is certainly a lot of interest from even other states. And I think, as you know, I had Senator James Maroney on the pod and a couple of other state lawmakers recently, and they've indicated some initial interest and maybe even some discussion about leveraging the drop to varying degrees.

[Alan Chappelle]

I'm curious if you're in position to.

[Podcast Host / Interviewer]

Maybe add some additional color around some of those discussions.

[Tom Kemp]

Absolutely. Thank you for asking about that. I mean, I'm not going to share the specifics of the conversations, but generally speaking, it's very safe to say that there's been over 10 states that have expressed interest in doing legislation to rein in data brokers, if not more. And right now we do have data broker registration laws in California, Oregon, Texas and Vermont. And there are a number of states, either their governors or politicians, that have publicly considered and proposed the delete act type legislation, including in Vermont, Nebraska, Illinois. Just heard about Virginia. And then the governor of New York expressed interest in this as well. So there's definitely a pain point. There's an itch that needs to be scratched here. And I think this is another example of California setting the pace for consumer protections and having other states foul. This has been true for over 100 years. That first started with food safety, then you got auto emission standards and automobile safety. California was the first state to have a data breach law. And of course, California was the first state to have a comprehensive privacy law. And now I think people are looking at California with a bit of envy and seeing that, hey, this delete act is something that consumers really want. So we are certainly interested in discussing with other states how we can help them to implement a delete act type style system like our drop system. Now, one unique thing about our privacy law, which was the California Privacy Rights Act, Prop 24 that amended the CCPA, is that it explicitly gives us, and it tells us that the agency should go out and work with other states, work with local legislators as well as other jurisdictions on privacy. And we will. So we will. We are having Conversations with other states about not only what the text should be, but also, you know, like how one would go about implementing this. And you know, from our perspective, helping other states adopt similar privacy measures will only cement the rights that we have here in California and make them stronger. And I think that's why that was built into the actual statute itself with Prop 24.

[Podcast Host / Interviewer]

So I may be reading into this a little bit, but it sounds like the discussions are a little bit more around, hey, we've built something pretty cool and we can provide some high level guidance on how you might want to build something equally cool rather than, hey, we've built something pretty cool, we'll license it or figure out how to add.

[Alan Chappelle]

Other states to the, to the larger.

[Podcast Host / Interviewer]

Mechanism closer to the former than the latter.

[Tom Kemp]

No, I think everything's on the table.

[Podcast Host / Interviewer]

Is that something that Cal Privacy could initiate it on its own or would.

[Alan Chappelle]

You need some form of authorization to include other states?

[Tom Kemp]

Well, we report to an independent board, so the board would have to approve that. So that would actually be, you know, public knowledge out there. And the board has actually expressed interest in doing that. And so to the extent of additional approval that would be needed or required, it really depends on the proposals that they get there. But look, we're open to all forms of cooperation with other states. And I want to point out that this is not just blue states, it's red states. We are, again I mentioned I'm not a political appointee. We are an independent agency and we work closely with Republicans here in California as well as Democrats. And likewise, it doesn't matter if it's Texas or it's Vermont or other states out there. In fact, we're also engaging with this organization that we helped set up called the Consortium of Privacy Regulators. And now I think it's at 10 or 11 different states are involved. And we even have Indiana, which is a red state, participating in this. So there's just a strong desire out there for cooperation. We're having these conversations. Everything's on the table in terms of specifically as it relates to delete act. And so if we get to the point where there's a concrete proposal, a memorandum of understanding, we will bring it forth to the board and have them weigh in on this. So it's, it's, we're, we're open for any conversations to the extent of providing guidance to sharing technology in some form or fashion.

[Podcast Host / Interviewer]

Well, that's fantastic. And collectively, with I think California taking the lead, you were stepping into what I think is a very clear void for better or worse, left by the federal government. So I want to shift gears a little bit, with your permission, and talk a bit about privacy harms. And I will confess that my thinking on this has evolved pretty significantly. Where I used to be a little bit more skeptical about we'll call ethereal harms. I'm almost air quoting here, or harms to dignity, but over the past few years, where there are serious risks to.

[Alan Chappelle]

The right of assembly and using location data to aid law enforcement efforts. That said, in an ad setting, outside.

[Podcast Host / Interviewer]

Of precise location, what privacy harms are you most concerned about and what impact.

[Alan Chappelle]

Do you think those harms have on Californians?

[Tom Kemp]

Yeah, no, we are concerned about the misuse or, and, or failure to protect sensitive personal information such as health, geolocation, et cetera. For example, we just came out with an enforcement action against a data broker, and they allegedly, you know, first saying that they didn't have any Californians data. And we were able to show that on their website. There was a spreadsheet where you could download with people with California, but they were also also selling lists of people with Alzheimer's and other medical conditions. And so that was a great deal of concern. And so the good news is, as part of this settlement, that they have exited the California market. And so at least through this data broker, you can't sell sensitive information such as if you have Alzheimer's. And I understand there could be valid reasons, and there are valid reasons for that, for having lists such as that for medical testing and all that stuff.

[Podcast Host / Interviewer]

Right. But I want to get outside of the, of health and location because most of my audience is really in the ad space. And so I wanted to better understand, you know, how are you thinking about harms within that space outside of precise location and health?

[Tom Kemp]

Okay. I mean, obviously we're also looking at things in terms of, you know, vulnerable members of our community, such as elderly and children, who are not in position to protect themselves. So what we've been doing from an enforcement perspective is really just trying to make sure that it's easy for consumers to be able to exercise their privacy rights. And if you look at the enforcement actions that we have been doing, we've been just trying to build building blocks of saying, look, that a business has been asking for too much information for a consumer to exercise their rights, that they haven't been supporting the global privacy control, and they've been in effect, kind of providing dark patterns as well. And so once we get kind of that baseline understanding and building blocks from an enforcement perspective, yeah, we certainly look to focus even more on specific issues regarding kids data as well as better protecting the elderly. So what we're trying to do is try to focus on concerns that reflect kind of the fears of average Californians that we serve. And the key thing of that is to facilitate that, is that we want to make sure that people are not blocked or there's any roadblocks or hurdles in their ability to exercise their rights. And so we're really trying to make privacy rights easy to exercise.

[Alan Chappelle]

That.

[Tom Kemp]

We've seen that with the drop system and then also through legislation, the California Opt Me out act, that provides that switch as well. So in some sense we kind of have to build the base, the framework to facilitate that. But then from there you will be seeing specific enforcement actions involving specific vulnerable communities that we think that need better protection.

[Podcast Host / Interviewer]

And, and what I'm hearing, and I just want to give you an opportunity to clarify what I'm hearing is a focus on rights more so than a focus on addressing specific harms. Again, outside of, you know, you've got health, you've got elderly, you've got kids, and you've got precise location, I suppose, but it seems to be the focus is, at least initially is on granting.

[Alan Chappelle]

Certain rights and less on the harms.

[Tom Kemp]

Well, I mean, clearly we did harms as it relates to some of the enforcement actions in the sensitive areas. But yes, I mean, you got to build kind of building blocks in terms of enforcement actions, in terms of enforcement advisories. And so once you kind of level set right there and kind of provide a baseline where and clear expectations, then there's the ability to kind of then target specific harms affecting vulnerable members of our community. And I think you will be seeing more specific areas that affect kids, elderly, etc. Coming from the agency. But we just have to kind of build up to that point to make sure that there's a level playing field as it relates to the ability to exercise rights.

[Podcast Host / Interviewer]

No, and fair enough. And I would say for whatever this is worth, in my view, the approach to enforcement thus far has been rather measured and seemingly fair. You've gone after very specific things. And so kudos. I mean, because the tendency with a new agency could be to come down and just start raining lightning bolts randomly on the marketplace. And you guys have clearly not taken that approach and you should be given.

[Alan Chappelle]

Some credit for that.

[Tom Kemp]

We're trying to set expectations. That's why when, when we do come up with the enforcement actions that we clearly spell out what the issues are, that's why we come out with Enforcement advisories. That's why we announce investigatory sweeps as well. So we're telegraphing exactly kind of the areas of focus. And so I think it. And then attorneys do a very good job of doing write ups. And so everyone kind of knows, as you said, we certainly don't want to do. We want to make sure that expectations are properly set and the expectation that we're clearly sending to people is that do not put burdens and too many hoops in front of consumers to enable the exercising of their privacy rights. And we're giving kind of building block examples through enforcement actions, through enforcement advisories, etc. To kind of level set. So look, at the end of the day, our being an entrepreneur, you know, we like clear in a past life, we like clear guidance. We're trying to provide clear guidance to businesses and setting expectations. We do want to enable operationalization of privacy rights, but we also want to make sure that our regulations, our law, our advisories can easily operationalized by businesses. And so we're trying to strike that balance between innovation and privacy rights as spelled out in the California Privacy Rights Act, Prop 24 that clearly said that as well. And so we're just trying to make sure that, you know, we're, we're doing the proper level setting across the board.

[Podcast Host / Interviewer]

So I, I want to shift again and, and we talked a bit about the drop. You have alluded to or maybe discussed a little bit some of the online. The, the opt out preference signals. The OOPS is. And I will note that the drop and the online.

[Alan Chappelle]

Sorry, the opt out preference signals, I just never.

[Podcast Host / Interviewer]

I like calling it an oops. I don't know why. But the drop and the OOPS together serve a similar role as is currently provided by authorized agents. And how do you see those two.

[Alan Chappelle]

Roles developing over time?

[Podcast Host / Interviewer]

I mean, is there going to be room for authorized agents down the line?

[Tom Kemp]

I mean the one thing that as we mentioned before with opt out preference signals we were able to sponsor a piece of legislation which was the California Opt Me out act, which was Assemblymember lowenthal, that was AB566 that does require web browsers to have that global privacy control setting which we call here in California called the opt out preference signal built in. To your point, that does enable privacy at scale. In the case of the drop system that that's focused on third party data. In the case of OOPS and GPC that's focused on first parties that consumers interact with and sending the signal to do not sell or share. Now specific to your Question about authorized agents and do they kind of fill a role or are they analogous? I will say that authorized agents are actually mentioned, I think about three or four times in the CPRA, the proposition 24, and they enable the consumer to exercise all their privacy rights. So in the case of the drop system, that's more focused on a certain set of businesses and specifically around deletions and opt out. In the case of opt out preference signal, that's for first party relationships with businesses and that's focused on just simply do not sell shares. Authorized agents are much broader, as you probably know, that they can facilitate exercising of all rights and it's not just limited to certain types of businesses. It facilitates the ability to exercise rights on behalf of consumers for all businesses as well. And I think that the reason why the author of the CPRA, which was Alastair McTaggart, who I know well, that he felt that authorized agents are an important option for consumers as there are many people out there that don't have the wherewithal or expertise to exercise their rights. For example, elderly parents or judges or elected officials who may be threatened, who, who may face having to do something in a short period of time and they don't have the time or the bandwidth or the expertise to do that. Or the reality is that in the current opt out mechanism that the average consumer doesn't have the time to chase down hundreds or thousands of different businesses and say opt me out. But that's sort of.

[Podcast Host / Interviewer]

My point though, Tom, is that the authorized agents seem to fit the same role as the deletion mechanism. No.

[Tom Kemp]

Yeah. So from my perspective, what opt out preference signal does as well as a drop system combined raises the floor. Right. And it does provide, you know, kind of analogous capabilities. But what I'm trying to say is, is that it's, it's not that there's still a very high ceiling up there and there probably should exist an ecosystem authorized agents. Now the ecosystem of those type of authorized agents may not necessarily be third party business. It may eventually evolve to we have AI agents working on our behalf, maybe built into the phone or browser kind of as you go about your day to day thing, they may tap you on the shoulder or may do things on your behalf as well. So the point is the law clearly allows for that and it allows for the exercising of rights for all your rights as well as for all types of businesses. But California, the legislature, because it was the legislature that built on top of this Lego block of the CCPA as amended by cpr, they added the delete act on top of it. They added the opt me out act on top of that said, okay, we like the rights that are available, we like the fact that authorized agents are enabled. But we need to raise the floor up because there's a lot of pain out there as it relates to consumers exercising privacy at scale. So if your thesis is drop and the global privacy control as implemented as oops here in California represents kind of a means and mechanism analogous to authorized agents, I agree with that thesis. But I also don't want to say that just doing drop and GPC is the end all or be all. I think what we'll see in the market is further evolution. You could even argue that these kind of commoditize certain aspects of the preexisting authorized agent market by raising the floor. But I still think that there's a lot of headroom out there. I don't know how that's going to be, but I do think there is a need out there especially for entities and people that just don't have the expertise to do that. And eventually that may just be a set of AI agents that work on our behalf.

[Podcast Host / Interviewer]

Okay, so that's helpful. I have a follow up question and it's sort of a similar question with respect to authorized agents and browser based implementation of GPC signals. In the case of browser based GPC signals, is California considering something that would similar to Connecticut where you would implement some flavor of anti preferencing measures? And this sort of gets back to what we were talking about with attention. You know, Apple has built a $16 billion ads business ever since ATT came on the scene. And so if a browser is basically saying that you know company X, what you're doing is a sale or a share, but our ad product is not, that would seem like a conflict of interest or a. And I'm just curious if the Cal privacy folks are thinking along those lines around setting up that type of anti preferencing measure.

[Tom Kemp]

Well, we did. At the last board meeting we set forth four areas of possible new regulations. It was approved by the board, one of which is streamlining privacy notices. Another one was better handling employee data. The third was better facilitating the exercise of privacy rights. And the fourth one was any additional regulations specific to the opt out preference signal in light of the passage of the Opt Me Out Act. So we are going to actually get public comment. We've already gotten a letter from I know you're affiliated with the NAI and we appreciate public comment on that. We haven't formally kicked off the public comment process on that. So I don't want to comment on that because that's something that we are going to first internally investigate. Then we're going to go out and get public comment and feedback on it as well. And we know that people have already brought that to our attention as well. So I don't want to put my thumb on the scale because I want to hear from all parties as it relates to is there additional regulations that we need in this area and hear from the public, hear from industry, hear from civil society groups. So yeah, so I think that is going to be something that will be discussed and we, we made it public that we're going to open it up and have regulations and at the next board meeting in February, we're going to give a timeline for when people can participate in this process with us and we'll go through that.

[Podcast Host / Interviewer]

Well, that's great to hear and I'm glad to hear that there's a commitment to a thorough investigation of some of those underlying issues. Apple and Google have attempted to block the requirement to have the global privacy control and their browsers. I mean, it was going to be passed by Governor Newsom a year ago. And, and my understanding is that there was a pretty, pretty robust lobbying effort to make sure that that doesn't happen. So I'm glad to hear that issue.

[Alan Chappelle]

Will at least be on the table for consideration.

[Podcast Host / Interviewer]

I, I want to ask a similar.

[Alan Chappelle]

Question with respect to authorized agents because.

[Podcast Host / Interviewer]

I, and I've, I've said this and I, I want to say it to you because I've sort of said it on previous pods. It feels like California has sort of unleashed this concept of authorized agents. And I'm curious if there's going to be some regulation around what good and bad practices for authorized agents are, because I can tell you that there's companies out there who are misrepresenting the law and are essentially cluster bombing ad tech companies with requests, which I just don't think is helpful. You know, I've said this publicly, so I just wanted to get your reaction. Is, is, you know, is that something that you guys can commit to taking a look at?

[Tom Kemp]

Well, as I mentioned before, authorized agents are built into the law that they were explicitly called out in the California Privacy Rights act, which was Prop 24. Furthermore, we've come up with regulations that actually regulate, have some regulations as it relates to authorized agents. And one of the new areas of regulations I mentioned before, which is reducing friction for people to exercise, we will look at if there's additional Things that need to be done as it relates to authorized agents. But I think going back to the statute, the actual law, which was again approved by the voters. So it's not Tom Kemp's opinion that it's in the law that, that there was a belief that there should be authorized agents to help facilitate for consumers. Because it's very difficult for in today's data economy with all the different websites, mobile apps that people interact with, that there is a need to provide assistance, much like there is a need out there for people to have help with their taxes. Right. So it's built into the legislature.

[Podcast Host / Interviewer]

Disagreeing with you that it's in the law. And I'm not disagreeing disagreeing with you that there's a need. Where I think there might be a slight point of disagreement is on the degree that that model should be regulated going forward.

[Tom Kemp]

It is regulated. We do have regulations and as I just said that we potentially will look at that and, and as part of the reducing friction. Because. And I've also been very clear that we do want to not only have the ability for consumers to operationalize the exercise of privacy rights, but I've also been very clear that we want to make sure that businesses can operationalize their obligations under California law and regulations. And so I very explicitly said that one of the four areas of new regulation, beyond the opt out preference signal, beyond employee data and streamlining privacy notices, is exercising of privacy rights, which would include potentially based on feedback that we get from industry, etc. Is that is there additional things that we have to do as it relates to authorized agents. So it's on the table and we look forward to, you know, investigating this as well, so.

[Podcast Host / Interviewer]

Well, good, And I appreciate that. And I take you at your word that there's going to be at least some, some mention of that or there's going to be some ability to provide feedback. Because I think there are. I think there are some things that that industry could do that would be much, much better and more transparent for consumers. For example, there is currently no requirement that they list the data brokers that.

[Alan Chappelle]

They are protecting one from. And that seems like a baseline transparency requirement. No.

[Tom Kemp]

Yeah, I mean, you're trying to kind of work the ref before the game's getting started on this. So I've made it quite clear that we're going to.

[Podcast Host / Interviewer]

The game started several years ago, Tom.

[Tom Kemp]

They exist actual reg. We're coming out with a set of new regulations and we want to get people's feedback. And I appreciate you guys providing this. And so you should definitely, you know, your, your listeners and anyone else. We certainly want to hear from you and, and we understand that, that we want to make it operationalized on, not only for consumers but also for businesses as well. So we're opening it up to like, how can we reduce friction out there? And I said that there's the ability to also provide content and feedback as it relates to authorized agents. And so we're opening this up, we're visiting this again and I don't know what else I can say that we're going to look at this.

[Podcast Host / Interviewer]

Great. No, I appreciate that and I'm glad to hear that there's going to be continued examination. So you have mentioned that Cal Privacy will target companies and I'm going to use air quotes here, walk and talk like a data broker, even if they don't claim that title. And I'm curious, how are you thinking about drawing that line, particularly with respect to companies operating in the digital media space.

[Tom Kemp]

We have to follow the statute and there is a definition of data broker. And then oftentimes that if there's some vagueness, then we go through the, with a given term or expression like direct relationship, then we go through the regulatory process. And the regulatory process is, you know, we get the public feedback and then we, we talk, we debate. And by the way, I have had so many besides civil society groups and meeting directly with consumers, I go to, I've been to a number of senior citizen meetings and hearing what they've said, but I also meet with industry as well. So it's complete open door. And to your point, we may, I think you mentioned before we started that there could be, you know, we can agree to disagree as well. So we went through that process to define what a direct relationship is, regulations as well. So we're just going to implement what the law and the regulations have to say. And so the law is very clear defining what a data broker is. And then we provided additional clarification as it relates to direct relationship. And so the goal is that we will fairly, you know, look at any entities that are acting like a data broker under the law. You know, we, we hope that they actually do register and the registration ends tomorrow. And so I don't know if this podcast is going to go out tomorrow.

[Podcast Host / Interviewer]

But by the time we, this comes out, it's going to be too late. And if I were you and you fit the definition of data broker, boy, you know, register tomorrow if you can.

[Tom Kemp]

Yeah, please, absolutely. If we can kind of go, go in the past. So yeah, no look, it's, we're just going to, we're just, we're following the statute. And again, we've been, we've been bent over backwards. Like we even came out with an enforcement advisory about, you know, data broker and registration. We came back out with that a month or two just to further help if people have subsidiaries that are doing certain type of things. So absolutely, we're just going to follow the law here. And, and this reflects the will of the legislature and of course the, our actual underlying privacy law reflects the will of the voters. And so our goal is to fairly, you know, enforce, you know, these laws.

[Podcast Host / Interviewer]

So I'm curious, do you see like retailers registering? Because a lot of them are using third party marketing profiles and using them off of their digital properties.

[Tom Kemp]

Yeah, we've been very clear that if you even, you may have a first party relationship, but then you start supplementing that with third party data and then you turn around and sell that third party data, then you actually fall under as a data broker. And then if a delete request comes in, you'll have to delete the third party information but retain the first party. It makes perfect sense. Just because you collect someone's email address and then you use the email address to completely supplement it with all this other third party information and then you send, sell it. Right. Then you're acting as a data broker. And so then if the drop, then if you, then when you register and the drop request comes in, you can still retain the email address that you got, but you have to get rid of the third party data that you were acting as a data broker with. So it's very clear, you know, from that perspective. So I don't know if it's specific or retail or whoever it is, but you know, it's clearly defined.

[Podcast Host / Interviewer]

What about a company like Palantir, do you see them registering?

[Tom Kemp]

I'm not allowed to. And I won't specifically call out, look at X, look at Y, look at Z. Is this company a data broker, et cetera? We're just going to go based on what the law and the regulations say. And I don't know in detail what their business practices are. And I just hope that people follow the law and if it turns out that they're not, then we have shown our ability to go out and aggressively enforce not only the registration, but I want to point out that just because you don't register doesn't get you off the hook with the fines that will happen come August, which is $200 per day per incident. So hopefully that is a big motivator that, you know, it's, you can't like wave your hands and say, oh, I'm going to not file the paperwork, etc. Well, no, actually you will get dinged for the fines right there, which most companies can afford them. Most of our fines have been 40, 50, $60,000, although in some cases we actually, as part of the enforcement action, we shut down a business, a data broker, and in the case of a more recent one that they agreed to not participate in the California market. So oftentimes the enforcement also has other aspects associated with it. But come this fall that irrespective if you register or not, if you're not doing the deletions, it's $200 per day per consumer record that matches in your.

[Podcast Host / Interviewer]

System and that adds up pretty quickly.

[Tom Kemp]

Very much so. So please register if you think you're a data broker.

[Podcast Host / Interviewer]

So Tom, this has been an absolutely fantastic discussion. I really appreciate you coming on. I know that I've sometimes asked what might be characterized as difficult questions, but this has been really helpful for me and I'm sure for my audience to better understand. Before I let you go though, I want to clarify one thing and I, because I may have misheard you with respect to Oops's like the global privacy control, that isn't just a first party.

[Alan Chappelle]

Signal, that's a third party in the.

[Podcast Host / Interviewer]

Old ad tech way of saying like that impacts, you know, third parties as defined under California law as well.

[Alan Chappelle]

No.

[Tom Kemp]

Well, I don't know. It's hard for me to give like legal interpretation. I don't know what the interaction is as well, but clearly because it's a browser plugin and you're sending the signal to the actual businesses that you're interacting with. So if there's that interaction and businesses can receive the signal, therefore they should do that. And again, we fully understand that now we're moving to AI and agentic browsers that there could be even further confusion on this. And so that's why we also have said again, we want to make sure businesses can operationalize this, that we're going to provide. You know, we're going to do research, we're going to get feedback to do further clarification of the actual, you know, opt out preference signal. Especially because we will see significantly enhanced adoption when come January 1st under the opt Me out act that all browsers will have to provide that as a switch that consumers can take advantage of. Yeah, so it's kind of hard for me because people start asking me, well, what about this company or what about this scenario? You know, I don't know. And I just would certainly just hope people would do the due diligence out there as well. And to the extent that we need to provide further clarification, we want that feedback as part of the regulatory process. So even before we write, put pen to paper, we're going to have sessions that, that people can write us letters or maybe even open sessions that people can call in and tell us what's that. At the same time, I want to be very clear to your audience. I meet with everyone, and so I'm more than happy if people want to have a further discussion on this. And that's why I went on your podcast, because I know your audience is a great audience right here. I want to make sure that we're open to listening and hearing what's going on. And we understand that there may be things that may not be working from an operationalized perspective. We certainly want to know about it because we want to make our privacy not only easy for consumers, but we want to make it as easy as possible for businesses because we firmly believe in what the statute said, which is we want to balance, you know, innovation with. With guardrails. And that's kind of having come from a business background and coming from the tech industry, I'm 100% supportive of guardrails. But let's not give businesses busy work as well. And if there needs to be areas of clarification, that's why we're going through this feedback process that we will announce in a couple weeks in February where people can send us letters or contact me and we can set up phone calls. More than happy to do that.

[Podcast Host / Interviewer]

Well, fantastic. I really appreciate that and I sure appreciate you coming on. Tom Kemp. Where can people find you? And Cal Privacy.

[Tom Kemp]

Yeah. So obviously go to privacy.ca.gov and that's kind of our new main website. We do have a cppa.ca.gov website. That's actually another late breaking news. We're going to be merging that into the privacy and we're going to, instead of having two sites, we're going to have one site and it's going to be the Privacy Ca. Gov website. So just go there. And we provide not only the drop system, but we provide privacy tips and, you know, check it out and, you know, reach out if you want to have a further conversation with us. More than happy to engage with people.

[Podcast Host / Interviewer]

Well, fantastic. And that, that comes across very loud.

[Alan Chappelle]

And clear here and I sure appreciate it.

[Podcast Host / Interviewer]

Tom Kemp. Thank you so much.

[Tom Kemp]

Hey, thanks a lot for having me.

[Alan Chappelle]

I really appreciated this discussion.

[Podcast Host / Interviewer]

We've gotten some great guests to come.

[Alan Chappelle]

Onto the podcast over the past year.

[Podcast Host / Interviewer]

And I think the reason people come.

[Alan Chappelle]

Here is to talk about difficult topics involving complex trade offs. So here are my thoughts after my discussion with Tom Kemp first, on privacy harms When I pressed Tom about what specific harms Cal Privacy is focused on in the digital ad space outside of health data, precise location, and vulnerable populations, the answer kept circling back to rights enforcement rather than demonstrable harms. Now, I understand the need to establish baseline compliance, but if we're going to regulate an entire industry and spend a non trivial amount of resources doing it, it's helpful to be crystal clear about what problems we're solving. This all ties into my comments on last week's podcast with David leduc that none of the big tech companies are registered as data brokers in California, and it's the reason I asked today whether Palantir was a data broker. California has made a series of policy choices regarding the rule set they are creating, and personally I think it's important to make sure that all of this is aligned with concrete privacy harms. I recognize that others may see things a bit differently. Second, on browser preferencing, Tom acknowledged that.

[Podcast Host / Interviewer]

Cal Privacy is at least open to.

[Alan Chappelle]

Putting browser anti preferencing measures similar to those provided by Connecticut on California's agenda. I hope they make good on that promise, because I think it's a problem for browsers to treat their own advertising products differently than third party ad services when implementing GPC signals. This is a critical issue, even more so given that Tom referenced the idea of providing even more power to browsers as authorized agents under California law. Here's some additional context we are no.

[Podcast Host / Interviewer]

Longer in the era where a browser.

[Alan Chappelle]

Is solely a user's agent. Companies like Perplexity clearly view their browser as a piece of software they can use to monetize. And even Apple has built a $16 billion advertising business after implementing App Tracking Transparency, a system that treats Apple's ad products differently from third party ad products. Competition regulators in Europe are viewing ATT as anti competitive and I think it would be a shame if California didn't at the very least have these competitive issues squarely on the table for public discussion. And finally, unauthorized agents. Tom made an interesting comment that the.

[Podcast Host / Interviewer]

Drop and GPC as implemented as an.

[Alan Chappelle]

Opt out preference signal commoditizes the authorized agent business as of today, at least with respect to deletion and opt out requests. It will be interesting to see what happens if more states adopt their own drop mechanisms. As of today, more authorized agents are focused on deletion requests, and there may be less of a market for those types of services in the upcoming years given that California is looking to offer those services for free. Tom repeatedly pointed to the fact that authorized agents are, quote, in the law and currently regulated. But being in the law doesn't mean the current framework is working. As I said, some authorized agents are misrepresenting the law, bombarding companies with questionable requests, and operating without basic transparency principles like disclosing which data brokers they're actually protecting consumers from. To his credit, Tom said that Cal.

[Podcast Host / Interviewer]

Privacy will look at these issues.

[Alan Chappelle]

I hope they do more than look, because this needs real attention. As I told Tom today, I give Cal Privacy credit for taking a measured approach to enforcement to date, and the enforcement does seem to be focusing on areas where consumers are are actually being harmed. The drop deletion mechanism is genuinely innovative and the early adoption numbers suggest real consumer demand.

[Podcast Host / Interviewer]

I do hope Cal Privacy keeps a.

[Alan Chappelle]

Public tally of how many Californians avail themselves of the drop mechanism, but as this agency matures, it needs to move beyond process and focus a bit more on outcomes. Are the rules being applied fairly across all players, and are we creating a system that protects consumers from something tangible? In any event, it was a great discussion and I hope was not the last time that Tom and his colleagues visit this podcast.

[Podcast Host / Interviewer]

We've got a bunch of other fantastic.

[Alan Chappelle]

Guests coming up on the Monopoly Report podcast over the next few weeks. Please subscribe to the [e-mail] or on Spotify, Apple, YouTube, or wherever you listen to your podcasts. And thanks for listening.