On March 14, 2025, the California Privacy Protection Agency (CPPA) announced the appointment of Tom Kemp as its new Executive Director, effective April 1, 2025. Kemp, a seasoned Silicon Valley entrepreneur, policy advisor, and author, brings a wealth of experience in privacy legislation, technology policy, and consumer protection to the agency.
Kemp’s professional journey includes founding and leading Centrify (now Delinea), a prominent cybersecurity cloud provider serving over two thousand enterprise customers, including more than 60% of the Fortune 50. His leadership at Centrify earned him recognition as a finalist for Ernst & Young’s Entrepreneur of the Year in Northern California. Beyond his entrepreneurial endeavors, Kemp has been a vocal advocate for robust privacy laws, playing a key advisory role in the passage of significant legislation such as the California Privacy Rights Act (Proposition 24), the California Delete Act (SB 362), and the California AI Transparency Act (SB 942). His advisory work also extends to other states, including Texas, Nebraska, Vermont, Washington, Illinois, and Maryland.
As an author, Kemp penned “Containing Big Tech: How to Protect Our Civil Rights, Economy, and Democracy,” a best-seller and top new release in multiple Amazon categories, including “Privacy & Surveillance” and “Computer & Internet Law.” He holds a Bachelor of Science degree in computer science and history from the University of Michigan.
The CPPA, established by the California Privacy Rights Act, is the nation’s only dedicated privacy rights enforcement agency. It is tasked with promoting education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act (CCPA). Kemp’s appointment marks a significant step for the CPPA as it continues to navigate complex privacy issues in an era of rapid technological advancement.
Recent CPPA Enforcement Actions
Under the leadership of its previous executive director, the CPPA has taken decisive actions to enforce the CCPA and hold businesses accountable for privacy violations. A notable example is the recent settlement with American Honda Motor Co., Inc. On March 12, 2025, the CPPA announced that Honda agreed to pay a $632,500 fine for mishandling customer data and violating CCPA regulations that we covered regarding their misconfigured cookie consent banners and other issues that a privacy expert either misled them or they just didn’t care at the time. The investigation revealed that Honda made it unnecessarily difficult for Californians to exercise their privacy rights, including forcing them to provide excessive personal information to opt out of data sharing. Additionally, Honda shared personal data with advertising technology companies without proper contracts to safeguard customer information. As part of the settlement, Honda committed to overhauling its privacy request processes, training employees, and updating contracts with third parties to ensure better protection of customer data.
Founders of the CCPA
The California Consumer Privacy Act (CCPA) was spearheaded by Alastair Mactaggart, a San Francisco-based real estate developer who became deeply concerned about online privacy and data protection. Mactaggart founded Californians for Consumer Privacy, a nationally recognized consumer privacy advocacy group, and was instrumental in creating and leading the ballot measure that resulted in the passage of the CCPA. His efforts were supported by co-author Rick Arney, who played a crucial role in drafting and advocating for the legislation.
Key Provisions of the CCPA
The CCPA grants California consumers several fundamental rights concerning their personal information:
- Right to Know: Consumers can request information about the personal data a business collects about them and how it is used and shared.
- Right to Delete: Consumers can request the deletion of personal information that a business has collected from them, subject to certain exceptions.
- Right to Opt-Out: Consumers can opt out of the sale of their personal information to third parties.
- Right to Non-Discrimination: Consumers have the right not to be discriminated against for exercising their CCPA rights, such as being denied goods or services or charged different prices.
CCPA Fines and Penalties
The CCPA authorizes the CPPA to impose administrative fines for violations:
- Up to $2,500 for each unintentional violation.
- Up to $7,500 for each intentional violation or violations involving minors’ personal information.
These fines are subject to increases for inflation.
The CPPA’s enforcement actions underscore its commitment to protecting consumer privacy and ensuring that businesses adhere to the law.
Tom Kemp’s appointment as Executive Director brings a leader with a deep understanding of privacy and cybersecurity to the CPPA. His extensive experience in the tech industry and advocacy for stronger privacy laws position him to effectively guide the agency in enforcing California’s privacy regulations and safeguarding consumer rights in the digital age.
