Separate CPPA administrative enforcement, Attorney General civil enforcement, and the narrow consumer action for qualifying security incidents.
Most CCPA violations do not give consumers a private CCPA lawsuit. They can still lead to an investigation, audit, order, injunction, fine, civil penalty, or settlement.
Structured answer sets in this page tree.
Cited legal and guidance references.
A CCPA enforcement issue can follow three paths. The California Privacy Protection Agency (CPPA) investigates, audits, and brings administrative actions. The California Attorney General may seek injunctions and civil penalties in court. A consumer may sue under the CCPA only for the security incidents defined in Civil Code section 1798.150, not for an ordinary notice, request, opt-out, or contract violation.
The CPPA may investigate a business, service provider, contractor, or other person after a sworn complaint or on its own initiative. Its regulations also permit investigations based on referrals and nonsworn or anonymous complaints. The Agency may audit compliance with any CCPA provision, and an audit may be announced or unannounced. If an administrative hearing finds a violation, the Agency may order the violator to cease and desist and pay an .
The Attorney General may bring a civil action in the name of the people of California for an injunction and civil penalties. If the Attorney General asks, the CPPA must stay its administrative investigation or action while the Attorney General proceeds. The statute also prevents the Attorney General from filing a civil action for the same violation after the Agency has issued the specified decision or order.
Yes. The regulations state that the CPPA may investigate on its own initiative and may use nonsworn or anonymous complaints, government referrals, or private-organization referrals. A sworn complaint has specific filing and attestation requirements, but it is not the only source of an investigation.
Yes. The CPPA may audit to investigate possible violations, but it may also select a subject because its processing presents significant privacy or security risk or because it has a history of noncompliance with privacy law. The regulations allow announced and unannounced audits.
An investigation does not itself establish a violation. At least 30 days before the Agency considers , it must notify the alleged violator, provide a summary of the evidence, and explain the right to appear with counsel. A probable-cause proceeding is private unless the alleged violator requests a public proceeding. If the Agency finds probable cause, it holds an Administrative Procedure Act hearing to determine whether a violation occurred.
The CPPA may decline to investigate or give time to cure, considering lack of intent and voluntary cure efforts made before Agency notice. That discretion is not an automatic cure period. A stipulated order can resolve a matter without an administrative hearing, but the Board must approve it; the final order is public and has the force of a Board order.
No. The CPPA may give a business time to cure and may consider voluntary cure efforts made before Agency notice, but the statute makes that discretionary. The separate 30-day probable-cause notice is procedural notice before the Agency considers ; it is not a guaranteed right to cure.
The statutory base amounts are adjusted for inflation. The amounts effective January 1, 2025 are not more than $2,663 for each violation and $7,988 for each intentional violation or violation involving personal information of a consumer the violator actually knows is under 16. Those adjusted amounts apply to CPPA administrative fines and Attorney General civil penalties. The statute requires another adjustment on January 1 of each odd-numbered year, so confirm the CPPA's current monetary-threshold page before estimating exposure.
Public remedies also include a cease-and-desist order or injunction. Good-faith cooperation must be considered when setting an or civil penalty. A business cannot be required to pay both an administrative fine and a civil penalty for the same violation.
Civil Code section 1798.150 creates a private action only when specified personal information is subject to unauthorized access and exfiltration, theft, or disclosure because the business violated its duty to use reasonable security. The covered information includes nonencrypted and nonredacted information defined in section 1798.81.5(d)(1)(A), and an email address combined with a password or security question and answer that permits account access. Other CCPA violations do not create a private action under this section.
For statutory damages, a consumer must give 30 days' written notice before filing. If a cure is possible and the business actually cures within that period and gives the required written statement, statutory damages cannot proceed on that noticed violation. Adding reasonable security after a breach does not cure that breach. No pre-suit notice is required for an individual action seeking only actual pecuniary damages.
Not under the CCPA's . Section 1798.150 limits that action to specified security incidents caused by a failure to maintain reasonable security. An ignored opt-out may still be investigated or enforced by the CPPA or Attorney General, and other law may create separate claims.
This US CCPA guide turns Enforcement and Penalties into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Enforcement and Penalties into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.