The California Privacy Protection Agency (CPPA) – the only independent data protection authority in the US – was created by the California Privacy Rights Act (CPRA), an amendment to the California Consumer Privacy Act (CCPA) that expands the law and creates new obligations for businesses.
In short, CPRA, which updates CCPA, created the CPPA.
Alphabet soup aside, California’s privacy protections are considered by most privacy pros to be the toughest and most comprehensive in the nation.
But is the California Privacy Protection Agency’s budget of $10 million enough to regulate against the largest technology companies in the world?
Alphabet – as in Google’s parent company, not soup – spent over $13 million on lobbying in DC last year alone, according to data from OpenSecrets, a Washington nonprofit that tracks campaign finance and lobbying data.
And Meta spent more than $19 million on lobbying activities in 2022, as per OpenSecrets.
None of which includes what Alphabet, Meta, et al., spend on dues for trade organizations, which also lobby on behalf of their membership.
Budget crunch
On Friday afternoon, the CPPA board hosted its regular public meeting to hash out issues, such as the structure of subcommittees, the ongoing rulemaking process – and its budget.
The board and several top members of the agency’s staff, including Executive Director Ashkan Soltani, spent more than one hour discussing in minute detail the process for obtaining their $10 million budget and how to get the cost-of-living adjustment they deserve, which would raise the budget to $11.18 million.
They also debated how and whether to recoup roughly $370,000 that might have been left on the table in 2021, when the CPPA was established and getting off the ground.
With so many formalities involved in government funding, it was difficult to follow the conversation. But one thing became abundantly clear: The CPPA has to jump through multiple hoops and cut through a prodigious amount of red tape in order to access the money that is earmarked for it under the law to bankroll its data protection and consumer education activities.
Meanwhile Google, Meta and many of the large companies the CPPA is meant to regulate can allocate tens of millions of dollars for their lobbying efforts without breaking a sweat.
“We are a tiny little agency facing the most powerful industry that the world has ever seen in terms of money and influence,” said Alastair Mactaggart, the real estate developer and privacy advocate who led the effort to pass both the CCPA and CPRA.
Mactaggart, who joined the CPPA board in October, was particularly frustrated during the meeting that the agency might not be getting all the money it merits under the law (as in, that potential $370,000).
But the CPPA has to justify every move.
The inside joke among staff, Soltani said, is that, “I would love to be able to walk down to the electronics store and purchase a printer, but it takes months and months to go through that process and a lot of staff time, and we’re doing it as … quickly as we can.”
(Pretty sure Alphabet and Meta have all the printers they need.)
