--- title: "California privacy law (CCPA): enforcement" canonical: "https://dposchool.com/state-privacy-laws/state/california/enforcement" source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) # California privacy law (CCPA): enforcement Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) The CPPA enforces through administrative proceedings and fines, and the Attorney General through civil actions; both amounts are adjusted for inflation every odd-numbered year. Since 2025-01-01 the maximum is $2,663 per violation, or $7,988 per intentional violation or violation involving consumers known to be under 16. There is no right to cure, although the CPPA may allow time to cure at its discretion. Consumers may sue only over certain data breaches, for $107 to $799 per consumer per incident or actual damages. ## Key points 1. CPPA administrative fines up to $2,663 per violation or $7,988 for intentional violations or those involving known minors under 16 (adjusted 2025-01-01). Section: [Cal. Civ. Code § 1798.155(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 2. Attorney General civil penalties at the same adjusted amounts, plus injunctions. Section: [Cal. Civ. Code § 1798.199.90(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 3. Amounts are adjusted for inflation on January 1 of each odd-numbered year; next adjustment due 2027-01-01. Section: [Cal. Civ. Code § 1798.199.95(d)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 4. No cure right; the CPPA may decline to investigate or give time to cure, considering intent and prior voluntary efforts. Section: [Cal. Civ. Code § 1798.199.45(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 5. Private action limited to breaches of certain unencrypted data from a failure of reasonable security: $107 to $799 per consumer per incident (adjusted) or actual damages. Section: [Cal. Civ. Code § 1798.150(a)(1)(A)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 6. Before suing for statutory breach damages, the consumer must give 30 days' written notice and a chance to cure. Section: [Cal. Civ. Code § 1798.150(b)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) ## Sources - [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) - [CPPA, Updated monetary thresholds in the CCPA (effective 2025-01-01)](https://www.cppa.ca.gov/regulations/cpi_adjustment.html) [Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) Reference material, not legal advice. ## Other topics for California - [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Enforcement Previous: [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents