Personal Information Security Breaches: The Private Right of Action

What it requires

The only provision of the CCPA a consumer may sue over, and it is far narrower than the rest of the title. It reaches a consumer whose nonencrypted and nonredacted personal information, as defined in Civ. Code § 1798.81.5(d)(1)(A), or whose email address together with a credential that would permit account access, is subject to unauthorized access and exfiltration, theft, or disclosure because the business failed to implement and maintain reasonable security procedures. Nothing else on the statute book — a missing opt-out link, an unhonored GPC signal, an undisclosed tracker — gives a consumer a cause of action; those are for the CPPA under § 1798.155 and the Attorney General under § 1798.199.90. Statutory damages run from one hundred dollars ($100) to seven hundred and fifty ($750) per consumer per incident in the printed text, adjusted under § 1798.199.95(d) to $107 and $799 effective January 1, 2025, with the next adjustment due January 1, 2027. A consumer may recover actual damages instead where they are greater.

Legal text (excerpt)

(a)(1)(A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. The amounts in this subdivision shall be adjusted pursuant to subdivision (d) of Section 1798.199.95.

Primary source