If you’re a privacy nerd like me you start to ask questions like who wrote the CCPA to bring the 21st century version of privacy laws to the United States. The California Consumer Privacy Act (CCPA) has emerged as one of the most significant data protection laws in the United States. This groundbreaking legislation grants California residents greater control over their personal information, setting a precedent for other states considering similar regulations.
But who was behind the creation of the CCPA? Who wrote this influential law, and what drove its inception? In this research piece, we explain the origins of the CCPA, the key figures who played a role in drafting it, and the impact it has had on consumer privacy rights from 1 law the CCPA to CPRA to now 20 states in the country that have privacy laws coming on the heels of the creation of the CCPA years ago.
Who Founded the CCPA?
The CCPA was spearheaded by Alastair Mactaggart, a wealthy real estate developer from San Francisco who became deeply concerned about online privacy and data security. Unlike most legislative initiatives that come from elected officials, the CCPA’s origins are rooted in a grassroots effort led by a private citizen who saw the growing risks of unchecked data collection.
Mactaggart’s interest in privacy began when he had a conversation with a Google engineer at a party. During their discussion, the engineer allegedly revealed just how much data companies were collecting on individuals—far beyond what most consumers understood. Alarmed by this revelation, Mactaggart decided to take action and advocate for a new privacy law that would give consumers more control over their data. This instantly makes Alastair a privacy superhero worthy of Captain Compliance status. He acted fast, came to the rescue, and drove results for the people of California.
How Was the CCPA Written?
Mactaggart, along with his team at Californians for Consumer Privacy, initially drafted a ballot initiative—a proposed law that, if it gained enough signatures, would be put directly to California voters. The initiative aimed to give Californians the right to know what personal data businesses collect, the ability to opt out of data sales, and the power to request data deletion.
This ballot measure quickly gained traction, garnering support from privacy advocates and public interest groups. However, tech companies—including Google, Facebook, and other data-driven businesses—strongly opposed it, fearing its impact on their advertising and data collection practices.
Faced with the possibility of the ballot measure passing, California lawmakers negotiated a compromise: if Mactaggart withdrew his initiative, the state legislature would pass a similar law. After intense discussions, the California Consumer Privacy Act (CCPA) was signed into law on June 28, 2018, by Governor Jerry Brown.
Key Figures in Drafting the CCPA
Although Alastair Mactaggart was the driving force behind the CCPA, several lawmakers played a crucial role in drafting and refining the bill, including:
- State Senator Bob Hertzberg (D-Van Nuys) – A longtime advocate for privacy rights, Hertzberg helped shape the bill’s language and ensure its passage through the legislature.
- Assemblyman Ed Chau (D-Monterey Park) – As the chair of the California Assembly Privacy and Consumer Protection Committee, Chau was instrumental in drafting and sponsoring the bill.
- California Attorney General’s Office – Played an advisory role in ensuring the law aligned with existing regulations and enforcement mechanisms.
How the CCPA Changed Consumer Privacy
The CCPA officially went into effect on January 1, 2020, transforming the way businesses handle personal data. Some of the most important rights granted under the law include:
- The Right to Know – Consumers can request a report on what personal data a business has collected about them.
- The Right to Delete – Consumers can request that businesses delete their personal information.
- The Right to Opt-Out – Consumers can opt out of the sale of their personal data.
- The Right to Non-Discrimination – Businesses cannot deny services or charge higher prices to consumers who exercise their CCPA rights.
These provisions put significant pressure on businesses to update their privacy policies, improve data security, and provide clearer opt-out mechanisms, such as cookie consent management platforms.
The CCPA’s Influence and Future Amendments
Since its enactment, the CCPA has had a ripple effect, inspiring other states to pass similar laws. However, due to criticisms that the CCPA didn’t go far enough in protecting consumer data, it was later expanded with the California Privacy Rights Act (CPRA) in 2020. The CPRA, which went into full effect in 2023, strengthened enforcement, established the California Privacy Protection Agency (CPPA), and introduced new rights, such as data correction and enhanced opt-out options.
Thank You To Alastair Mactaggart, Ed Chau, and Bob Hertzberg
From the privacy superheroes at Captain Compliance we want to send a thank you to the pioneers of the the California Consumer Privacy Act (CCPA) as their relentless work stands as a testament to how a single concerned citizen—Alastair Mactaggart—can spark a movement that reshapes data privacy laws. With support from legislators like Bob Hertzberg and Ed Chau, the law was enacted as a compromise between privacy advocates and businesses. CIPA and VPPA are old privacy laws that have reinvigorated lawsuits from Swigart Law and Pacific Trial Attorneys as there are private rights of actions in those but not in most state level privacy laws unless there is a data breach.
Since its passage, the CCPA has changed how companies handle consumer data, inspired new privacy laws, and pushed businesses toward greater transparency. As privacy concerns continue to grow, laws like the CCPA and CPRA signal a shift toward a future where consumers have more control over their personal information.
Businesses must now take proactive steps to ensure compliance with these evolving laws—leveraging tools like Captain Compliance’s Consent Management Platform to handle cookie consent, privacy notice updates, and data subject requests efficiently.
By understanding the founders, authors, and impact of the CCPA, companies and consumers alike can appreciate the ongoing efforts to protect data privacy in the digital age.