Law / United States / 
California
CCPA/CPRA Enforcement: California Privacy Protection Agency and Private Right of Action
Cal. Civ. Code sections 1798.150, 1798.155, 1798.199.10, 1798.199.90
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Expect administrative enforcement from the California Privacy Protection Agency and the Attorney General, with civil penalties up to $7,988 for an intentional violation or one involving a consumer under 16 (the 2025 inflation-adjusted amount).
- Maintain reasonable security procedures for a California consumer's unencrypted, unredacted personal information; a breach caused by their absence exposes your business to a private lawsuit for $100 to $750 in statutory damages per consumer per incident, which cannot be cured by improving security after the fact.
These lines are LexLint's reading of the law's text. Also read by: California Privacy Protection Agency (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d). The Agency's most recent adjustment, effective , raised the two figures to $2,663 and $7,988 (the higher figure is the one for an intentional violation). Section 1798.199.90(a) gives the Attorney General a parallel civil-penalty power at the same as-enacted and adjusted amounts, assessed and recovered in a civil action brought in the name of the People.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Statutory damages
Civ. Code section 1798.150(a)(1)(A): a consumer whose nonencrypted, nonredacted personal information is breached because a business violated its duty to maintain reasonable security may recover not less than $100 and not more than $750 per consumer per incident, or actual damages, whichever is greater, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d) to $107 and $799 effective (the statute states a range rather than culpability tiers). Section 1798.150(b) allows a consumer to pursue statutory damages 'on an individual or class-wide basis,' so a class action is available.
- As of
- Currency
- USD
- Per person minimum
- 107
- Per person reckless
- 799
- Class action available
- Yes
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from to , read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on ; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (); a marketing firm fined for selling audiences without data broker registration (); a round of data broker enforcement actions announced together (, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (); Ford Motor Company, ordered to change practices and pay a fine (); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (); a second data broker enforcement action the same week (); and an action against a Virginia data broker (). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. The register text does not give a dollar figure for every action; the figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the remainder. The newsroom is paginated: the to entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
Settledness
The guidance is the Agency's implementing regulation on probable cause proceedings, which is a binding rule rather than advisory guidance.
- As of
- Guidance link
- https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- Guidance body
- California Privacy Protection Agency
- Open questions
- When is a cure "possible" under Civil Code section 1798.150(b) for a breach in which personal information has already been exfiltrated, given that later implementation of reasonable security procedures "does not constitute a cure with respect to that breach"?
What it makes you log
Logging duty
Sections 1798.150, 1798.155, 1798.199.10 and 1798.199.90 set the private action for a security breach, the Agency's administrative fines, the Agency's establishment and the Attorney General's civil action. None names a log, a record the business keeps, a retention period, a duty to produce a record or an inspection power over one. The Agency's investigation and audit powers are in section 1798.199.65 and 11 CCR 7300 to 7304, which this row does not cite. No territorial reach is stated, so no hook is written.
- Kind
- None
- As of
What this law does
The California Privacy Protection Agency, which assumed enforcement authority , and the Attorney General share administrative enforcement of the CCPA/CPRA, with civil penalties currently up to $2,663 per violation or $7,988 per intentional violation or one involving a consumer known to be under 16, inflation-adjusted for 2025 under a streamlined adjustment mechanism AB 3286 (2024) put in place.
There is no general private right of action for a CCPA violation; a narrow one exists only under section 1798.150 for a business's failure to maintain reasonable security resulting in a breach of unencrypted, unredacted personal information, carrying statutory damages of $100 to $750 per consumer per incident and a 30-day cure notice that does not excuse a breach already suffered.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .