Separate CPPA administrative enforcement, Attorney General civil enforcement, and the narrow consumer action for qualifying security incidents.
Most CCPA violations do not give consumers a private CCPA lawsuit. They can still lead to an investigation, audit, order, injunction, fine, civil penalty, or settlement.
A CCPA enforcement issue can follow three paths. The California Privacy Protection Agency (CPPA) investigates, audits, and brings administrative actions. The California Attorney General may seek injunctions and civil penalties in court. A consumer may sue under the CCPA only for the security incidents defined in Civil Code section 1798.150, not for an ordinary notice, request, opt-out, or contract violation.
The CPPA may investigate a business, service provider, contractor, or other person after a sworn complaint or on its own initiative. Its regulations also permit investigations based on referrals and nonsworn or anonymous complaints. The Agency may audit compliance with any CCPA provision, and an audit may be announced or unannounced. If an administrative hearing finds a violation, the Agency may order the violator to cease and desist and pay an .
The Attorney General may bring a civil action in the name of the people of California for an injunction and civil penalties. If the Attorney General asks, the CPPA must stay its administrative investigation or action while the Attorney General proceeds. The statute also prevents the Attorney General from filing a civil action for the same violation after the Agency has issued the specified decision or order.
Yes. The regulations state that the CPPA may investigate on its own initiative and may use nonsworn or anonymous complaints, government referrals, or private-organization referrals. A sworn complaint has specific filing and attestation requirements, but it is not the only source of an investigation.
Yes. The CPPA may audit to investigate possible violations, but it may also select a subject because its processing presents significant privacy or security risk or because it has a history of noncompliance with privacy law. The regulations allow announced and unannounced audits.
Sources (2)
Binding source for CPPA investigations and administrative actions, Attorney General civil actions, hearings, orders, and coordination between the two public enforcers.
Current regulations for sworn complaints, investigations, probable-cause proceedings, stipulated orders, and Agency audits.
An investigation does not itself establish a violation. At least 30 days before the Agency considers , it must notify the alleged violator, provide a summary of the evidence, and explain the right to appear with counsel. A probable-cause proceeding is private unless the alleged violator requests a public proceeding. If the Agency finds probable cause, it holds an Administrative Procedure Act hearing to determine whether a violation occurred.
The CPPA may decline to investigate or give time to cure, considering lack of intent and voluntary cure efforts made before Agency notice. That discretion is not an automatic cure period. A stipulated order can resolve a matter without an administrative hearing, but the Board must approve it; the final order is public and has the force of a Board order.
No. The CPPA may give a business time to cure and may consider voluntary cure efforts made before Agency notice, but the statute makes that discretionary. The separate 30-day probable-cause notice is procedural notice before the Agency considers ; it is not a guaranteed right to cure.
Sources (2)
Binding source for discretionary cure consideration, the 30-day probable-cause notice, and the administrative hearing and order.
Current regulations for probable-cause procedure and public stipulated orders.
The statutory base amounts are adjusted for inflation. The amounts effective January 1, 2025 are not more than $2,663 for each violation and $7,988 for each intentional violation or violation involving personal information of a consumer the violator actually knows is under 16. Those adjusted amounts apply to CPPA administrative fines and Attorney General civil penalties. The statute requires another adjustment on January 1 of each odd-numbered year, so confirm the CPPA's current monetary-threshold page before estimating exposure.
Public remedies also include a cease-and-desist order or injunction. Good-faith cooperation must be considered when setting an or civil penalty. A business cannot be required to pay both an administrative fine and a civil penalty for the same violation.
Sources (2)
Official current amounts effective January 1, 2025: $2,663 and $7,988 for administrative fines and civil penalties, with the higher amount covering intentional violations and specified violations involving consumers under 16.
Binding source for administrative fines, civil penalties, good-faith cooperation, and the rule against both public monetary penalties for the same violation.
Civil Code section 1798.150 creates a private action only when specified personal information is subject to unauthorized access and exfiltration, theft, or disclosure because the business violated its duty to use reasonable security. The covered information includes nonencrypted and nonredacted information defined in section 1798.81.5(d)(1)(A), and an email address combined with a password or security question and answer that permits account access. Other CCPA violations do not create a private action under this section.
For statutory damages, a consumer must give 30 days' written notice before filing. If a cure is possible and the business actually cures within that period and gives the required written statement, statutory damages cannot proceed on that noticed violation. Adding reasonable security after a breach does not cure that breach. No pre-suit notice is required for an individual action seeking only actual pecuniary damages.
Not under the CCPA's . Section 1798.150 limits that action to specified security incidents caused by a failure to maintain reasonable security. An ignored opt-out may still be investigated or enforced by the CPPA or Attorney General, and other law may create separate claims.
Sources (1)
Binding source for the covered security incidents, available relief, 30-day notice for statutory damages, cure limits, and the exclusion of private actions for other CCPA violations.
Assign owners to preserve the affected practice and records, calculate notice-specific response dates, and track remediation without treating discretionary cure as a guaranteed period.
Turn Enforcement and Penalties into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.