Loading story…
The California Privacy Protection Agency (CPPA) has approved three new draft bills aimed at strengthening data privacy protections in the state. The most notable proposal introduces anti-retaliation safeguards and financial incentives for whistleblowers who report companies violating California's privacy laws, with the goal of encouraging insiders to provide valuable information to regulators. The CPPA emphasized that such whistleblower contributions would enhance enforcement efforts, particularly in cases involving complex data processing and emerging technologies.
In addition to whistleblower protections, the draft legislation seeks to expand Californians' rights to have their personal data deleted. The proposed changes would allow residents to request the removal of personal information not only collected directly by businesses but also obtained from third parties. These measures follow recent legislative successes, including a law signed by Governor Gavin Newsom that simplifies consumer opt-outs from data sharing via web browsers, further strengthening privacy rights for California residents.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The California Privacy Protection Agency advanced a proposal to expand protections for whistleblowers who report potential violations related to data privacy. The development was reported in coverage published on November 10-11, 2025, with no earlier specific event date provided in the references.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California Governor Gavin Newsom signed **SB 813** and **AB 1405**, creating a statewide framework for independent third-party assessments of artificial-intelligence systems. SB 813 authorizes independent verification organizations to evaluate AI systems and models for compliance with California law, while AB 1405 establishes a state registry for AI auditors and requires standards for auditor independence, transparency, and integrity. The measures expand California’s AI safeguards as the state deploys AI in resident services, agency operations, and potentially critical infrastructure. California is advancing the AskCA resident-services assistant, Anthropic Claude tools for agencies, and internal testing of the Poppy assistant, while increasing oversight of AI vendors seeking state contracts. Newsom described the laws as part of responsible AI innovation and called for corresponding federal action.
Sep 11, 2026
California’s **Privacy Protection Agency (CalPrivacy)** announced a settlement action against Texas-based **Rickenbacher Data (doing business as DataMasters)**, fining the company and **banning it from selling Californians’ personal information** as part of a broader enforcement crackdown on data brokers. The action was brought by the agency’s enforcement division and its **Data Broker Enforcement Strike Force**, following CalPrivacy’s stated intent to increase investigations into data broker privacy violations. Regulators said DataMasters traded in data tied to **sensitive health conditions**—including lists associated with **Alzheimer’s disease, drug addiction, and bladder incontinence**—and also bought and sold lists segmented by demographics and inferred attributes such as **“Seniors,” “Hispanic,” political affiliation, grocery purchases, banking activity, and health-related purchases** for targeted advertising. CalPrivacy stated the company conducted these activities in **2024 without registering with the California Data Broker Registry**, a requirement under California’s data broker rules.
Jun 29, 2026
California Governor Gavin Newsom issued an executive order accelerating the state's independent AI-model safety oversight program, advancing the launch target for its AI auditor registry and related requirements from December 2028 to the end of 2027. The Government Operations Agency must establish application criteria and procedures for independent AI verification organizations by May, while the order urges stronger federal involvement in regulating developers of frontier AI models. State officials and outside experts must recommend possible changes to California AI-safety laws by November 16, including recurring independent audits, expanded reporting of critical safety incidents, and emergency mechanisms to shut down models that become unsafe or uncontrollable. Newsom said experts will define the technical and governance requirements of a potential AI "kill switch," acknowledging that the concept remains immature.
Sep 18, 2026