US CPRA penalties and fines

Civil Code Sections 1798.155 and 1798.199.90 state base maximums of $2,500 per violation and $7,500 for the enhanced tier. For administrative fines, that tier covers intentional violations and violations involving personal information of consumers the violator actually knows are under 16. For Attorney General civil penalties, it covers intentional violations and violations involving personal information of minor consumers. The Agency adjusts the amounts every odd-numbered year. The adjustment effective January 1, 2025 raised both sets of caps to $2,663 and $7,988. These remain the posted current amounts in 2026; check the Agency's current thresholds for the date of the alleged violation.

A per-violation cap does not determine how many violations occurred or the final amount. The Agency or court must apply the statute to the facts. Good-faith cooperation must be considered when setting an administrative fine or civil penalty, and a business cannot be required to pay both for the same violation.

The adjusted private statutory-damages range effective January 1, 2025 is $107 to $799 per consumer per incident or actual damages, whichever is greater. That range belongs to the limited security-breach action in Section 1798.150; it is not available for every CCPA violation.

The California Privacy Protection Agency can investigate and bring an administrative enforcement action against a business, service provider, contractor, or other person that violates the CCPA. After the statutory hearing process, the Agency may order the person to cease and desist and pay an administrative fine.

The Attorney General may bring a civil action in the name of the people of California for an injunction and civil penalties. If the Attorney General asks, the Agency must stay its administrative action or investigation so the Attorney General can proceed. The Attorney General cannot file a civil action for the same violation after the Agency has issued the specified decision or order.

The statute does not provide a blanket 30-day right to cure before government enforcement. The separate 30-day notice provision in Section 1798.150 applies to a consumer seeking private statutory damages for a qualifying security breach.

The private security-breach action in Section 1798.150 is limited to a breach involving either nonencrypted and nonredacted personal information within the categories cross-referenced from Civil Code Section 1798.81.5(d)(1)(A), or an email address combined with a password or security question and answer that would permit account access. The information must have been subject to the specified unauthorized access and exfiltration, theft, or disclosure because the business failed to implement and maintain reasonable security procedures and practices appropriate to the information.

The consumer may seek the adjusted statutory-damages range or actual damages, whichever is greater, as well as injunctive or declaratory relief and other relief the court considers proper. The court selects statutory damages after considering circumstances such as the seriousness, number and persistence of violations, duration, willfulness, and the defendant's financial position.

Before filing for individual or class-wide statutory damages, the consumer must give 30 days' written notice identifying the specific CCPA provisions alleged to have been violated. If a cure is possible and the business actually cures within that period and gives the required written statement, the statutory-damages action may be barred. Adding reasonable security after a breach does not cure that breach. No pre-suit notice is required for an action seeking only actual pecuniary damages.

This private action cannot be based on another CCPA section. Other causes of action may exist under other law, but this page does not determine them.

Build the record around the alleged provision and event, not a generic penalty estimate. Preserve the version of the law, regulation, notice, interface, contract, request workflow, security control, and system behavior in effect at the relevant time. Record the number of consumers and events only from supported evidence; do not multiply a cap by an assumed violation count.

For a rights-handling allegation, retain request timestamps, identity-verification steps where permitted, opt-out signals, response and extension notices, decisions, downstream instructions, and testing records. For a security incident, retain forensic evidence, affected-data analysis, control design and operation, incident chronology, notices, remediation, and any Section 1798.150 demand.

Document cooperation and corrective action without calling them a guaranteed cure or penalty reduction. The statute requires consideration of good-faith cooperation, but the authority or court determines the final effect.