CCPA penalties
Published 17 min read
A CCPA fine is priced per violation, so the bill follows how many Californians a broken process touched; and not one published penalty so far was about a data breach.
The amounts, as of 1 January 2025
The CCPA sets ceilings, not fixed fines, and it sets them for each violation. Three money lines exist, and two of them are the same number collected by different enforcers. The California Privacy Protection Agency (CPPA, which now also calls itself CalPrivacy) fines in its own administrative process; the Attorney General sues for civil penalties in court; consumers can sue only after certain data breaches. These are the amounts the CPPA published for 2025, read 22 Oct 2026:
| Who imposes it | Per violation | Intentional, or a consumer known to be under 16 | Base amount in the statute | Section |
|---|---|---|---|---|
| CPPA administrative fine | $2,663 | $7,988 | $2,500 / $7,500 | § 1798.155(a) |
| Attorney General civil penalty | $2,663 | $7,988 | $2,500 / $7,500 | § 1798.199.90(a) |
| Consumer lawsuit after a data breach | $107 to $799 per consumer per incident | or actual damages, if greater | $100 to $750 | § 1798.150(a)(1)(A) |
CPPA, “Updated Monetary Thresholds in CCPA”, effective 1 Jan 2025; Civil Code as posted by the CPPA; read 22 Oct 2026. | ||||
The higher tier is not reserved for bad faith alone. A violation involving the personal information of a consumer the business actually knows is under 16 is priced like an intentional one, whatever the intent. The statute’s own text still prints $2,500 and $7,500; the agency adjusts every amount in the table for inflation on 1 January of each odd-numbered year, using the California Consumer Price Index from August to August and rounding to the nearest dollar.
The next adjustment is due on 1 January 2027. Any page quoting $2,663 or $7,988 after that date needs a fresh read of the CPPA’s adjustment page; this one shows its read date for that reason.
The table only matters once the law reaches you. The three tests for that are in what the CCPA is, and the CCPA threshold calculator runs them on your own figures.
How a fine adds up: per violation, not per case
The CPPA’s head of enforcement put the method plainly when the Honda decision came out: the agency will “tally fines based on the number of violations”. The Honda order shows the count. Of the $632,500, it ties $382,500 to named groups of consumers:
| Consumers who… | Count |
|---|---|
| Had to give more information than necessary to opt out of sale or sharing, or to limit | 119 |
| Had those requests denied because Honda required them to verify themselves first | 20 |
| Had to confirm with Honda directly that they had authorised an agent to act for them | 14 |
| Total consumers counted | 153 |
| Fine the order ties to them | $382,500 |
| Which is, per consumer | $2,500 |
CPPA Board, Order of Decision and Stipulated Final Order, American Honda Motor Co., ¶ 75; read 22 Oct 2026. | |
One consumer, one violation, at the statute’s unadjusted $2,500. The order does not tie the other $250,000 to a count. Small numbers of people still produce six-figure fines, because each of them is a separate violation.
The Ford order counts differently. It says Ford “violated Civil Code section 1798.120(d) each time Ford subsequently sold or shared the personal information of a consumer who previously submitted a request to opt-out”. Read that way, an opt-out left unprocessed is not one violation but one for every later sale or share, for as long as the data keeps flowing.
Tally the ceiling
Pre-filled with the 153 consumers counted in the Honda order. Change either input.
Consumers affected, or each sale after an ignored opt-out.
Most the statute allows for this count
$407,439
153 × $2,663. A ceiling, not a forecast: the Board or a court sets the figure, and one consumer can account for more than one violation.
Every published CCPA penalty, in date order
Two official lists hold the record: the CPPA Board’s table of enforcement decisions and the Attorney General’s privacy enforcement actions. Every case they list under the CCPA that ended in a penalty is below, with the regulator’s own announcement as the source and the amount in its own words.
14
published CCPA penalties from the two public enforcers, 24 Aug 2022 to 11 Aug 2026
$12.75 million
the largest: General Motors, 8 May 2026
6 and 8
decided by the CPPA Board, and brought by the Attorney General
| Business and enforcer | Announced | Penalty | What it turned on |
|---|---|---|---|
| SephoraAttorney General | 24 Aug 2022 | $1.2 million | Did not disclose that it sold personal information, did not process opt-outs sent by Global Privacy Control, and did not cure inside the 30-day period the law then allowed. |
| DoorDashAttorney Generalalso CalOPPA | 21 Feb 2024 | $375,000 | Traded customer data to a marketing cooperative, which the AG treated as a sale, without notice or a way to opt out. |
| Tilting Point MediaAttorney Generalwith the Los Angeles City Attorney; also COPPA | 18 Jun 2024 | $500,000 | Collected and shared children's data in a mobile game without parental consent. |
| American Honda Motor Co.CPPA Boardorder 7 Mar 2025 | 12 Mar 2025 | $632,500 | Demanded verification and excess data for opt-out and limit requests, offered cookie choices asymmetrically, burdened authorised agents, and lacked contract terms with ad tech firms. |
| Todd SnyderCPPA Boardorder 1 May 2025 | 6 May 2025 | $345,178 | A misconfigured privacy portal left opt-outs unprocessed for 40 days; it also asked for too much information and for identity verification before an opt-out. |
| Healthline MediaAttorney Generalalso the Unfair Competition Law | 1 Jul 2025 | $1.55 million | Kept sharing with ad partners after readers opted out, used article titles suggesting a diagnosis to target ads, and assumed rather than checked its contract terms. |
| Tractor Supply CompanyCPPA Boardorder 26 Sep 2025 | 30 Sep 2025 | $1,350,000 | A privacy policy that did not tell consumers their rights, no notice to job applicants, no effective opt-out (Global Privacy Control included), and disclosures without contracts. |
| Sling TV and Dish Media SalesAttorney General | 30 Oct 2025 | $530,000 | Routed the opt-out through cookie settings, made logged-in customers refill known details, offered no opt-out in its TV apps, and no opt-in for viewers under 16. |
| Jam CityAttorney General | 21 Nov 2025 | $1.4 million | No CCPA opt-out in any of its 21 mobile games, and some games sold or shared data of 13- to 15-year-olds without opt-in. |
| The Walt Disney CompanyAttorney General | 11 Feb 2026 | $2.75 million | Applied opt-outs, Global Privacy Control included, to one service or one device instead of the whole logged-in account. |
| PlayOn Sports (2080 Media)CPPA Boardorder 27 Feb 2026 | 3 Mar 2026 | $1.10 million | Made ticket holders accept tracking to use their tickets, sent opt-outs to industry pages instead of its own method, ignored opt-out signals, and gave too little notice. |
| Ford Motor CompanyCPPA Boardorder 27 Feb 2026 | 5 Mar 2026 | $375,703 | Required email verification before an opt-out and did not process opt-outs where the step was not completed. |
| General MotorsAttorney Generalwith four District Attorneys, CalPrivacy supporting; also the Unfair Competition Law | 8 May 2026 | $12.75 million | Sold drivers' location and driving data to two data brokers without notice, kept it beyond its purpose, and said in its policy that it did not sell such data. |
| LocateSmarterCPPA Boardorder 10 Aug 2026also the Delete Act; $116,490 in all | 11 Aug 2026 | $79,890 | A data broker that required the last four digits of a Social Security number before an opt-out. |
Each name links to the regulator’s announcement. LocateSmarter shown at its CCPA fine; read 22 Oct 2026. | |||
Added up, the announced penalties come to $24,938,271. 5 of the actions also rested on another law (COPPA, CalOPPA, the Unfair Competition Law or the Delete Act), and their announcements give one figure; only the LocateSmarter order splits its CCPA and Delete Act fines. Every one ended by agreement: each Board decision adopts a stipulated final order, and each Attorney General action was announced as a settlement.
What is not on this list
- Most of the Board’s decisions so far are under the Delete Act alone: data brokers that did not register. Those fines are the Delete Act’s own, set out on the California data broker registry page.
- Court fights that are not penalties, such as the CPPA’s August 2025 petition to enforce a subpoena against Tractor Supply. The agency dropped that litigation when the Board decided the matter in September.
- Open investigations. The Tractor Supply petition was, in the CPPA’s words, its first public disclosure of one.
What the cases turned on
Read across, the docket is not about hackers. None of the penalties above came from a data breach (the one kind of case consumers can bring themselves). They came from ordinary machinery: the form behind a link, the tags on a page, the contract with an ad partner. 11 of the 14 cases turned, at least in part, on an opt-out that was too hard, did not work everywhere, or ignored a browser signal.
7 of 14 cases
The opt-out did not work everywhere
A portal that stopped processing, no method inside an app, or a choice that reached one device or one service and not the account.
Todd Snyder, Healthline Media, Tractor Supply Company, Sling TV and Dish Media Sales, Jam City, The Walt Disney Company, PlayOn Sports (2080 Media)
5 of 14 cases
The opt-out asked for too much
Identity checks, extra fields, a confirmation email or a partial Social Security number in front of a request that needs none of them.
American Honda Motor Co., Todd Snyder, Sling TV and Dish Media Sales, Ford Motor Company, LocateSmarter
4 of 14 cases
A browser signal was ignored
Global Privacy Control or another opt-out preference signal received and not acted on, or acted on for one browser only.
Sephora, Tractor Supply Company, The Walt Disney Company, PlayOn Sports (2080 Media)
4 of 14 cases
Notices missing or wrong
A privacy policy that did not describe the rights, no notice to job applicants, or a policy that misdescribed what happened to the data.
DoorDash, Tractor Supply Company, PlayOn Sports (2080 Media), General Motors
3 of 14 cases
Selling without saying so
Data swapped in a marketing cooperative or sold to brokers while the policy said nothing, or said the opposite.
Sephora, DoorDash, General Motors
3 of 14 cases
Data passed on without the contract
Ad tech partners and other recipients got personal information with no agreement carrying the terms the CCPA requires.
American Honda Motor Co., Healthline Media, Tractor Supply Company
3 of 14 cases
Children's data without opt-in
Selling or sharing the data of consumers known to be under 16 without opt-in: their own at 13 to 15, a parent's under 13.
Tilting Point Media, Sling TV and Dish Media Sales, Jam City
3 of 14 cases
More data, or more use, than the purpose needed
Keeping data after its job was done and selling it on, using it beyond the purpose it was collected for, or demanding data a request did not need.
Healthline Media, General Motors, LocateSmarter
Buying the tool is not the defence. When the Board fined Todd Snyder over a privacy portal that left opt-outs unprocessed for 40 days, the CPPA’s head of enforcement said: “Using a consent management platform doesn’t get you off the hook for compliance.” Whichever of the consent management platforms you run, test the opt-out end to end yourself, on every surface, after every release.
How a case runs, and who gets to bring it
The CPPA’s cases run through its own administrative process; the Board decides. On paper the path is long. In practice every CCPA decision so far adopted a stipulated order the business had agreed with the Enforcement Division, so most of these steps were settled, not fought.
- 01A sworn complaint, or the agency's own initiativeAnyone can file. The agency may decline to investigate, or give the business time to cure, weighing a lack of intent and fixes made before it was notified.§ 1798.199.45(a)
- 02Subpoenas and auditsThe agency can compel testimony and documents. In August 2025 it went to court for the first time to enforce one, against Tractor Supply.§ 1798.199.65
- 03Notice at least 30 days before probable causeThe business gets a summary of the evidence and the right to attend with counsel. The probable-cause proceeding is private unless the business asks for it to be public.§ 1798.199.50
- 04Hearing and orderA hearing under the Administrative Procedure Act. The order can require the business to cease and desist and to pay a fine for each violation.§ 1798.199.55(a)
- 05Review in courtAny decision on a complaint or a fine can be challenged, under an abuse of discretion standard.§ 1798.199.85
- 06CollectionAn unpaid fine becomes a court judgment; the agency has four years to seek it.§§ 1798.199.75, .80
The clock: no administrative action can start more than five years after the violation, and serving the probable-cause notice is what starts it. The five years stop running while a business fraudulently conceals what it did, or while it fails to produce documents a court has ordered it to hand over (§ 1798.199.70).
“The agency may decide not to investigate a complaint or decide to provide a business with a time period to cure the alleged violation.”
That is a discretion, not a right. The original law gave businesses 30 days to cure after notice, and Sephora was penalised in 2022 partly for not curing inside it. By the DoorDash settlement in 2024 the Attorney General was saying that violations cannot be cured. The change is laid out in what the CPRA changed.
The Attorney General’s lane
- The Attorney General sues in court in the name of the people of California, for an injunction and civil penalties of the same amounts. The court may weigh the business’s good-faith cooperation.
- If the Attorney General asks, the agency must pause its own investigation or action and step aside, unless the Attorney General then decides not to go ahead.
- Once the agency has issued its decision against a business, the Attorney General cannot sue it for the same violation.
- The two can also work together: the General Motors settlement was the Attorney General’s and four District Attorneys’, with the CPPA supporting.
Where the money goes
CCPA money is ring-fenced. It lands in the Consumer Privacy Fund, which the Legislature may not spend or transfer for any other purpose (§ 1798.160(a)(2)). Ninety-five percent of every fine, penalty and settlement is earmarked for the enforcer that won it, for its CCPA work; the other five percent goes to a grant subfund the CPPA splits three ways: privacy nonprofits, children’s online privacy education, and law enforcement work against fraud after data breaches (§ 1798.160(d)).
CPPA fines and settlements
95% to the Consumer Privacy Subfund, used only by the CPPA for its duties; 5% to the Consumer Privacy Grant Subfund.
§ 1798.155(b)
Attorney General penalties and settlements
95% to the Attorney General Consumer Privacy Enforcement Subfund, to support CCPA enforcement; 5% to the Consumer Privacy Grant Subfund.
§ 1798.199.90(b)
One exception: when a settlement comes out of a joint investigation, the Attorney General may move part of its share to the agency’s subfund to repay its investigative costs (§ 1798.199.90(b)(1)(B)).
The one lawsuit consumers can bring: a data breach
Consumers cannot sue under the CCPA for an ignored opt-out or a missing notice; the statute rules out a private action for any section except one. That one is § 1798.150, and it needs all of this:
- nonencrypted and nonredacted personal information as defined in § 1798.81.5(d)(1)(A), or an email address together with the password or security question and answer that would open the account;
- unauthorised access and exfiltration, theft or disclosure of it;
- caused by the business failing to keep reasonable security procedures and practices suited to the information.
Then the consumer can recover $107 to $799 per consumer per incident, or actual damages if greater, plus an injunction. The range multiplies across a class:
$1,070,000
floor of statutory damages if 10,000 Californians are in one incident
$7,990,000
ceiling for the same incident; the court places the award by seriousness, persistence, wilfulness and the business's means
Before suing for statutory damages, alone or as a class, the consumer must give 30 days’ written notice naming the provisions breached. If the business cures within those 30 days and says so in writing, no claim for statutory damages can follow. A claim for actual money lost needs no notice. And the obvious fix does not count as a cure:
“The implementation and maintenance of reasonable security procedures and practices pursuant to Section 1798.81.5 following a breach does not constitute a cure with respect to that breach.”
Check your own exposure against the cases
Each question below is one the regulators have already answered against somebody. A yes on all of them is not a clean bill of health, and this is information, not legal advice; a no is a finding waiting to happen.
- 01Does the opt-out ask for anything beyond what you need to act on it, or for proof of identity first?Cases: American Honda Motor Co., Todd Snyder, Sling TV and Dish Media Sales, Ford Motor Company, LocateSmarter
- 02Does one opt-out reach every app, device and service tied to the account, and does someone test it after each release?Cases: Todd Snyder, Healthline Media, Tractor Supply Company, Sling TV and Dish Media Sales, Jam City, The Walt Disney Company, PlayOn Sports (2080 Media)
- 03Does the site act on a Global Privacy Control signal, and show the visitor that it did?Cases: Sephora, Tractor Supply Company, The Walt Disney Company, PlayOn Sports (2080 Media)Use the Global Privacy Control checker
- 04If data leaves for anything of value (a co-op, a broker, an ad network), does the policy say you sell or share?Cases: Sephora, DoorDash, General MotorsUse the Do Not Sell or Share link guide
- 05Does every ad tech and analytics recipient sit under a contract with the CCPA terms, checked rather than assumed?Cases: American Honda Motor Co., Healthline Media, Tractor Supply Company
- 06If under-16s use the product, is selling and sharing their data off until they, or a parent for under-13s, opt in?Cases: Tilting Point Media, Sling TV and Dish Media Sales, Jam City
- 07Do the privacy policy and the notice to job applicants describe the rights and how to use them?Cases: DoorDash, Tractor Supply Company, PlayOn Sports (2080 Media), General MotorsUse the notice at collection template
- 08Is each data set kept and used only for the purpose it was collected for, and does each request form ask only for what it needs?Cases: Healthline Media, General Motors, LocateSmarter
Turn the noes into owned tasks with the CCPA compliance checklist, starting with the opt-out path, since that is where most of the cases above turned.
CCPA penalties on one page
- CPPA fine
- Up to $2,663 per violation; $7,988 if intentional or involving consumers known to be under 16 (§ 1798.155(a))
- Attorney General penalty
- The same amounts, in a civil action in court (§ 1798.199.90(a))
- Breach lawsuit
- $107 to $799 per consumer per incident, or actual damages if greater (§ 1798.150(a)(1)(A))
- Amounts change
- 1 January of every odd year; next 1 January 2027 (§ 1798.199.95(d))
- How it is counted
- Per violation: per consumer in the Honda order, per later sale in the Ford order
- Cure
- At the CPPA's discretion only (§ 1798.199.45(a)); 30-day notice and cure for breach suits (§ 1798.150(b))
- Time limit
- Five years from the violation for a CPPA action (§ 1798.199.70)
- Where the money goes
- 95% to the enforcer's own subfund, 5% to the grant subfund (§§ 1798.155(b), 1798.199.90(b))
- Published penalties
- 14 so far; the largest $12.75 million (General Motors)
Statute and CPI amounts as posted by the CPPA; cases from the CPPA Board and the Attorney General, read 22 Oct 2026. Information, not legal advice.
Questions
Is a CCPA fine counted per consumer, per violation or per case?
Per violation, and the enforcer decides what one violation is. The Honda order tied $382,500 of its fine to 153 named consumers, $2,500 each. The Ford order went further and treated every later sale or share of an opted-out consumer’s data as a separate violation.
Does a business still get 30 days to cure?
Not automatically. The 30-day cure in the original law is gone. The CPPA may give time to cure, weighing lack of intent and fixes made before it got involved, but it does not have to. The only fixed cure period left is the 30-day notice a consumer must give before suing over a breach, and adding security after the breach does not count as a cure.
Can a consumer sue a business for ignoring an opt-out?
Not under the CCPA. Its private right of action covers only certain data breaches caused by a failure of reasonable security, and the statute says it cannot be based on any other section. Opt-outs, notices and contracts are enforced by the CPPA and the Attorney General.
Can the CPPA and the Attorney General both go after the same violation?
The statute keeps them apart. The agency must stay its own investigation if the Attorney General asks to proceed, and the Attorney General cannot sue over a violation the agency has already decided. They can investigate together, as in the General Motors case.
Does using a consent management platform protect a business?
No. Todd Snyder used a privacy portal that failed to process opt-outs for 40 days, and the Board fined the business, not the vendor. The agency’s head of enforcement said a consent management platform “doesn’t get you off the hook”.
How far back can the CPPA reach?
Five years from the violation, counted to the date the probable-cause notice is served. The clock stops while a business fraudulently conceals what it did or ignores a court order to produce subpoenaed documents.
Will the $2,663 figure change?
Yes, on 1 January 2027, when the CPPA adjusts every CCPA dollar amount for inflation, as it does each odd-numbered year. This page shows its read date beside the figures for that reason.