CalPrivacy’s First Enforcement Chief Joins Latham & Watkins: What His Record Says About California Enforcement

The person who built California’s privacy enforcement team from scratch now works for the companies that team investigates. Michael Macko, the California Privacy Protection Agency’s first head of enforcement, has joined Latham & Watkins as a partner in its Bay Area Privacy & Cyber Practice and its Litigation & Trial Department, the firm announced on October 26, 2026. He left the agency, which now calls itself CalPrivacy, on September 8.

Moves from regulator to private practice are routine in Washington and Brussels. This one is worth a closer look because of what Macko built and what his departure says about where California enforcement is going. Companies that want to understand how CalPrivacy picks its cases have a good map in his record.

What Macko built at CalPrivacy

When CalPrivacy announced his departure in August, board chair Jennifer Urban credited Macko with growing the Enforcement Division “from one person—Mike—to a mature division housing one of the strongest privacy enforcement teams in existence.” According to Latham’s announcement, he oversaw hundreds of matters, supervised investigations and litigation, set the agency’s approach to fines and injunctive relief, and published enforcement advisories on data minimization, data brokers and deceptive design.

The headline cases under his watch show the agency’s priorities.

• American Honda Motor Co. agreed in 2025 to pay $632,500 and change its practices after the agency found it required too much information for opt-out requests and used an unbalanced cookie consent tool. Our summary of the Honda settlement covers the details.
• Tractor Supply Co. was fined a record $1.35 million in 2025 over failures in its privacy notices, opt-out handling and job applicant privacy rights, described in our article on the Tractor Supply fine.
• Ford Motor Co. was ordered to pay $375,703 after the agency found that requiring consumers to verify an email address before opting out added unnecessary friction. See our analysis of Ford’s CCPA fine.
• Data brokers faced a steady run of fines for failing to register under the Delete Act, alongside enforcement under the state’s consumer privacy law.

He also set up partnerships that will outlast him: a bipartisan Consortium of Privacy Regulators with state attorneys general, work with the Federal Communications Commission, and formal cooperation with regulators in the U.K., France and Korea.

The pattern behind the cases

Read together, the cases share a theme. CalPrivacy has gone after the mechanics of privacy rights, not just policy wording. The questions it asked were practical ones. How many steps does it take to opt out? Does the cookie tool give equal weight to “accept” and “reject”? Do contracts with ad tech vendors contain the terms the law requires? Does the privacy notice cover job applicants?

That focus makes sense for a regulator with limited staff. These failures can be found from outside, by visiting a website and trying to use it. They are also easy to explain to a judge. It is a good bet the approach will continue under his successor, especially as the agency expands audits, which we covered in our piece on CalPrivacy’s growing audit function.

What the move means for companies

Bloomberg Law, which first reported the hire, noted that Macko will now advise clients on the kind of state privacy compliance matters he once oversaw. A few practical points follow.

1. Expect more California-style enforcement thinking in defense work. Former regulators bring knowledge of how cases are chosen and settled. Companies on both sides of a matter will be reading the same playbook.
2. Do not expect enforcement to slow. CalPrivacy is recruiting a new deputy director to lead a division it describes as one of the largest and most active privacy enforcers worldwide. Agency priorities are set by the board and staff, not one person.
3. Revolving-door rules apply. California and federal ethics rules limit what former officials can do on matters they worked on. Companies with open CalPrivacy matters should expect Macko to be walled off from those.
4. Multistate coordination is here to stay. The Consortium of Privacy Regulators means a weakness found in California can quickly come up in other states.

A self-check based on the cases he led

Companies do not need a former enforcer to run the basic tests. Try these on your own site this month.

• Submit an opt-out of sale or sharing as a consumer would. Count the steps and note any information you are asked for that is not strictly needed.
• Look at your cookie banner. Are “accept” and “reject” equally easy to choose? Does rejecting actually stop advertising tags from firing?
• Turn on Global Privacy Control in your browser and check that your site treats it as an opt-out.
• Read your privacy notice as a job applicant would. Does it cover applicant data?
• Pull your contracts with advertising and analytics vendors and check for the CCPA’s required service provider or third-party terms.
• If you are a data broker, confirm your registration is current and accurate.

Our article on what CPPA enforcement will look like next goes deeper on preparation.

Where Captain Compliance fits

Captain Compliance offers consent management, hosted privacy notices, a data subject request portal and a cookie scanner, plus a scan that checks a URL for GPC signals and dark patterns. Those tools address several of the mechanics California has enforced on, and our CPRA solution page describes how they fit together. Using them does not guarantee compliance, and contracts and back-end data flows still need their own review.

Frequently asked questions

Who is Michael Macko?

He was the first head of enforcement at the California Privacy Protection Agency (CalPrivacy). He left on September 8, 2026 and joined Latham & Watkins as a partner in October 2026.

Who replaces him at CalPrivacy?

The agency advertised the deputy director of enforcement role in August 2026 with an application deadline of September 4. A successor had not been publicly named in the material we reviewed.

Will California privacy enforcement slow down?

Nothing suggests it will. The division is staffed, has ongoing matters, and works with other states through the Consortium of Privacy Regulators.

What kinds of violations has CalPrivacy fined?

Mostly practical failures: too many steps or too much information to opt out, unbalanced cookie banners, missing contract terms, notice gaps and data broker registration lapses.

Can a former regulator work on cases against his old agency?

Ethics rules restrict former officials from working on matters they handled. Specific limits depend on the matter and applicable law.

The playbook left with him, and also stayed

Macko’s move means the people defending companies now include someone who designed the enforcement program. It also means the program he designed is written down in public decisions, advisories and settlement terms that anyone can read. Companies that study those documents and fix what they describe will be in a better position than those waiting to hire the people who wrote them.