Omar Moncayo, City of Long Beach; Norman Sadeh, Carnegie Mellon University; Gwen Shaffer, California State University, Long Beach
Cities increasingly rely on digital technologies to manage transportation, utilities, public services, and other urban functions. These technologies, operated by both municipal agencies and private vendors, collect and process data about people in many everyday contexts. Despite existing privacy regulations, residents often lack practical ways to understand these data practices or exercise applicable rights, and cities face challenges translating policy into scalable, operational solutions.
This presentation describes ongoing work to deploy a Smart City Privacy Infrastructure in partnership with the City of Long Beach. The effort builds on California’s consumer privacy framework and leverages CMU’s IoT Privacy Infrastructure to support greater transparency and accountability across a broad ecosystem of smart city technologies, including mechanisms that allow people to rely on authorized agents, as envisioned under CCPA, to help manage privacy interactions at scale. We discuss the motivation for this work, the architectural approach used to support heterogeneous systems, and the practical challenges encountered when working with individual city departments and external vendors. The talk highlights progress to date, including onboarding technologies spanning transportation, mobility services, utilities, and other urban deployments, as well as the launch of a city-facing assistant application to help people discover and understand data collection in their environment. We conclude by discussing lessons learned, remaining challenges, and opportunities for broader adoption.
Omar Moncayo is a Data Privacy Analyst with the City of Long Beach, where he works at the intersection of privacy, technology policy, and public sector innovation. His work focuses on advancing responsible data practices within municipal systems, supporting compliance with evolving privacy regulations, and embedding privacy-by-design principles into city operations and digital services. Moncayo has played a key role in community-facing initiatives that promote data literacy, transparency, and public engagement around emerging technologies, including artificial intelligence. He collaborates closely with academic and civic partners to translate privacy and governance concepts into practical tools and processes that serve residents and city stakeholders.
Norman Sadeh is a Professor in the School of Computer Science at Carnegie Mellon University, where he co-founded and co-directs CMU’s Privacy Engineering Program and previously co- founded and co-directed the PhD Program in Societal Computing for a decade. He has served as lead principal investigator on two of the largest U.S. research initiatives in privacy: the Usable Privacy Policy Project and the Personalized Privacy Assistant Project. He was also founding CEO and, until its acquisition by Proofpoint, chairman and chief scientist of Wombat Security Technologies, a company that defined the multi-billion dollar user-oriented cybersecurity market. Technologies Norman developed with colleagues at CMU and Wombat are used to protect tens of millions of users around the world against cybersecurity attacks such as phishing. Earlier in his career, he also served at the European Commission as Chief Scientist of the 550M Euro eWork and eCommerce initiative, which included all pan-European research in cybersecurity and privacy and related policy activities.
Gwen Shaffer is a Professor in the Department of Journalism and Public Relations at California State University, Long Beach, and serves as Director of Research for the College of Liberal Arts. Her research focuses on telecommunications policy, data privacy, and the social and regulatory implications of smart city technologies. Shaffer has led and collaborated on interdisciplinary, externally funded projects examining privacy, digital governance, and community-centered technology design, including work with municipal partners to develop tools that help residents better understand and manage data collection practices. She previously served on the City of Long Beach Technology and Innovation Commission, including as chair, contributing to local policy development around digital inclusion, surveillance technologies, and responsible data use.
author = {Omar Moncayo and Norman Sadeh and Gwen Shaffer},
title = {Designing for Civic Trust: An Infrastructure to Help Long Beach Residents Manage Their {CCPA} Rights},
year = {2026},
address = {Santa Clara, CA},
publisher = {USENIX Association},
month = jun
}
