The current public-enforcement caps are $2,663 per violation and $7,988 for an intentional violation or a violation involving personal information of a consumer the violator actually knows is under 16.
The limited security-breach private action currently allows $107-$799 per consumer per incident or actual damages, whichever is greater. Do not estimate a total until the enforcement path and unit of violation are established.
Structured answer sets in this page tree.
Cited legal and guidance references.
CCPA monetary exposure depends on who is enforcing, what provision was violated, whether the violation was intentional or involved a known consumer under 16, and how many legally distinct violations or qualifying security incidents occurred. The California Privacy Protection Agency published the amounts below for January 1, 2025. The statute requires adjustments every odd-numbered year, so check the current CPPA threshold before using them in a live matter.
For CPPA administrative enforcement, the current cap is $2,663 for each violation. The current higher cap is $7,988 for each intentional violation or violation involving personal information of a consumer the violator actually knows is under 16. The Attorney General's civil-penalty caps are the same, and an Attorney General action can also seek an injunction.
These are maximum amounts, not automatic charges. The Agency or court determines the amount from the facts and governing law. The statute requires consideration of good-faith cooperation, and the Attorney General penalty provision expressly lets the court consider good-faith cooperation.
No. They are current for public enforcement, not fixed charges. The violation, enforcement route, facts, intent, age knowledge, and legally supported violation count still have to be established. Good-faith cooperation must be considered when setting the amount.
The current statutory-damages range is $107-$799 per consumer per incident, or actual damages if greater. A court may also grant injunctive or declaratory relief and any other relief it considers proper. The action is limited to the data and event conditions in Civil Code section 1798.150; it does not apply to every CCPA violation or every security event.
For , the court considers circumstances including the nature and seriousness of the misconduct, number of violations, persistence, duration, willfulness, and the defendant's assets, liabilities, and net worth. Those factors guide an award within the range; they do not create a mechanical exposure formula.
No. Section 1798.150 requires specified personal information, a qualifying unauthorized access and exfiltration, theft, or disclosure, and a causal connection to the business's failure to maintain . A different security incident may create duties or claims under other laws without meeting this CCPA private-action test.
Cure rules differ by path. In a section 1798.150 claim for , a consumer must give 30 days' written notice. If a cure is possible, an actual cure plus the required written assurance can bar statutory damages for the noticed violation. Implementing after a breach does not cure that breach. In public enforcement, the CPPA may allow time to cure, but no automatic cure period applies.
Cooperation enters the amount analysis but does not erase a violation. California Civil Code section 1798.199.100 requires the Agency or court to consider good-faith cooperation and prevents a business from being required to pay both a CPPA administrative fine and an Attorney General civil penalty for the same violation. A private section 1798.150 claim remains a separate path.
Estimate a range. First identify the enforcement path and the exact provision or security-incident test. Then determine the relevant acts, consumers, incidents, dates, systems, and responsible entities. Apply an amount only after counsel has a supported basis for the unit of violation or incident.
Keep the adjusted amount and the statutory base amount separate in the record. The CCPA requires inflation adjustments on January 1 of every odd-numbered year, so the amount can change even when the underlying violation rule does not.
This US CCPA guide turns penalties and fines into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn penalties and fines into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.