California's privacy regulator at its 'strongest,' former enforcement chief says

September 17, 2026, 23:42 GMT | Comment The California Privacy Protection Agency, or CalPrivacy, since its inception in 2020, has evolved into one of the most "powerful" privacy regulators in the world, which both domestic and international agencies come to for guidance and collaborations, Michael Macko, its first enforcement chief, said Wednesday* as he left the role for the private sector.

"I left the agency in the strongest place it's ever been, and that is a testament to the team that is there that has been working since the agency's creation. I wouldn't have left otherwise," the 45-year-old enforcer said in an interview with MLex after more than three years at the agency. He left the job last Tuesday.

Macko left the agency with an enforcement team that he said will be well equipped to carry out even more effective enforcement at a time when the public is increasingly aware of privacy regulation, and enforcement is only going to be more deepened.

According to Macko, CalPrivacy under his leadership has sought to build up cases and create precedents, instead of focusing on getting big players and high penalties for eye-catching headlines, an approach he described as more effective in providing guidance for businesses.

"The agency is poised to succeed, and I've achieved what I set out to do, which is build a world-class team and a world-class infrastructure for privacy enforcement," he said. "Looking ahead, I feel like it's an unprecedented time in our economy and for tech regulation in general, where states are going to be stepping up and bringing more and more creative enforcement actions when it comes to use and collection of data."

"Building one of the largest and most powerful privacy regulators in the world" is one of his biggest achievements and the enforcement team is "really impressive," Macko said. "I'm proud of the technologist team that we've created, and I'm also really proud of the relationships that we have built with other states and with other countries."

When he joined in 2023, he said he set out to build a culture that values fairness, transparency and justice, calling those "the North Stars for me as a prosecutor."

The people he got to hire for the enforcement team are like-minded and have diverse backgrounds and strong skill sets. "We have shared values, and those values include doing the right thing, bringing enforcement actions when it's the right thing to do, not because you're seeking a headline. Those things are important," Macko said.

He said the team is "a combination of people who have hardcore litigation backgrounds, in-house counsel, advising backgrounds, other regulatory agency backgrounds."

Highlighting the team's "innovative spirit," he said, "It's a combination for me of choosing the right cases to pursue [and] fashioning relief that's novel and that addresses problems that are emerging."

Macko joined the agency following a 10-year career at the US Department of Justice, as well as a stint as a prosecutor at the Securities and Exchange Commission. Early in his career, he worked at a law firm and clerked for judges. Just before joining CalPrivacy, he worked at Amazon for nearly two years.

— Enforcement —

During Macko's tenure, the agency issued enforcement advisories, conducted sector-wide regulatory sweeps and cracked down on data brokers. The agency's enforcement has led to fines or settlement payments in the millions. In a collaborative action with other California regulators including the California Department of Justice, GM agreed to pay $12.75 million to settle allegations over misuse of data.

Many of CalPrivacy's enforcement actions, which often resulted in fines or settlements of tens of thousands of dollars, pale in comparison to the GM settlement. The biggest case aside from GM was a $1.35 million settlement with Tractor Supply Company.

Macko has refrained from going after a big name or a big dollar amount because one of the most important things for a new enforcer is "to build out precedent," he said. "The approach that I took ... was to go for breadth, go for a broad scope, try to bring a larger volume of cases and actions to cover different areas of the law."

The strategy is to provide more guidance to the industry by hitting more areas of the law and bringing more actions, instead of chasing headlines. "When given the choice between different ways of being an effective enforcer, I went for volume. I went for breadth," he said.

But the regulator is also capable of going after big players. "I can't speak to anything that's nonpublic, but I can tell you that where we were in the process when I left was that the enforcement division was poised to be even more effective in the years to come," he said.

— Leading others —

"California likes to be first at everything, and California has always been an innovator state when it comes to law and regulation," Macko said. It has become "a hub for states nationwide grappling with privacy enforcement issues."

California created the Consortium of Privacy Regulators, which allows state agencies to exchange ideas and coordinate enforcement. The consortium now has regulators from nine states.

Internationally, what California does is also being closely followed. "I have been surprised by the level of interest internationally at what California is doing with privacy in particular. I'm not sure I expected that," Macko said.

California's size is a factor. "California is the fourth largest economy in the world, and that's going to get interest," he said, adding that having a dedicated agency for privacy enforcement is "a bold move."

There are formal relationships between the agency and the CNIL in France, the Personal Information Protection Commission in South Korea and the UK Information Commissioner's Office, "but those aren't the only relationships," he said.

Macko said one of the most common questions he gets at international conferences is what California's role in privacy enforcement and privacy policy is, given what's going on in other states or at the federal level. "The answer is that there's a remarkable harmony between the states right now on privacy enforcement issues."

— Public awareness —

After more than three years after enforcing privacy law, "I think the public is increasingly aware of the importance of personal information and personal data in the economy," Macko said. Even in rural Pennsylvania, where he's from, "people care about privacy."

Macko agreed that enforcement has a role to play in achieving that.

"This is a trend that we've seen over the last few years. I don't think it's going away that states are going to be increasingly looking at how companies are using personal information, how they are collecting personal information. All of that exists separate from the conversation about AI, which is legitimate," he said.

In the context of artificial intelligence, "the fuel of AI is personal information," he said. "States are able to regulate the inputs of AI right now, in some cases using laws that are 100 years old, and in some cases using laws that are newer, like California's privacy law."

"What is brewing under the surface is that ... states nationwide are building out their capacity to handle more of these technical cases, and they can do it without going after AI. They can go after the inputs," he said.

For companies, "the potential liability [of privacy violations] has changed. So, not only are companies exposed to liability under comprehensive privacy laws, but they're also exposed to existing liability for unfair or deceptive acts or practices."

Macko has not announced where he is going in the private sector. During his time at CalPrivacy, he rarely took vacations.

"I know that this job that I did was a really big one, and I was really motivated to do it. When you're that enthusiastic and motivated about a goal, it's easy to forget to take the vacations that you should," he said.

But he knew that’s not a good example to lead by. "I tried my best to instill in my team the idea that they shouldn't follow my example, because to be an effective enforcer and to be a good attorney and to have a fulfilling legal career, you do need to take care of yourself," he said.

*Corrected on Sept. 18, 2026 at 15:30 GMT: A previous version of this story said the interview was on Thursday.

Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.