What Is CPPA?

The California Privacy Protection Agency (CPPA) is the regulatory body responsible for enforcing the CCPA, including investigating violations and levying fines. It's distinct from the CCPA itself, the CPPA is the enforcer, the CCPA is the law, and its enforcement actions are one of the clearest real-world signals of how the law gets interpreted in practice.

The distinction between the law (CCPA) and its enforcer (CPPA) matters because enforcement actions are where abstract legal requirements become concrete. In the CPPA’s 2026 decision fining PlayOn Sports $1.1 million, the order says ticket holders had to click “Agree” to tracking before they could use their tickets, were pointed to industry opt-out tools instead of PlayOn’s own, and had their opt-out preference signals ignored. A CMP or banner that puts a choice on screen isn’t enough if the choice doesn’t work. Watching what the CPPA actually pursues is often a better guide to real compliance risk than the statute alone.