On November 7, 2025, the California Privacy Protection Agency (CalPrivacy) voted to advance three legislative proposals that, if enacted, would materially reshape certain compliance obligations under the California Consumer Privacy Act (CCPA).
The first legislative proposal would create a whistleblower program that would provide financial awards to incentivize insiders to report CCPA violations and include anti-retaliation protections to shield employees who come forward. Instead of a private right of action, the program would allow CalPrivacy to partner with whistleblower attorneys to share portions of administrative fines.
The second legislative proposal would expand consumers’ right to delete personal data, including data held by third parties, potentially increasing the operational complexity of deletion workflows and vendor management. If this proposal is enacted, businesses would need to reassess data mapping, contractual obligations, and technical processes to ensure downstream deletion across service providers and other third parties in compliance with the proposal.
The third legislative proposal would make it easier for consumers to submit privacy requests by requiring online-only businesses to offer additional submission methods beyond a single designated email address. If enacted, this could necessitate added interfaces, verification mechanisms, and additional resources for businesses.
Businesses should monitor these proposals closely and prepare for more robust internal reporting protocols and expanded data request handling capabilities. While details remain to be finalized, these legislative proposals indicate that consumer rights and practical accessibility continue to remain enforcement priorities.
[View source.]
