Civil Penalties in an Attorney General Enforcement Action

What it requires

California has two public CCPA enforcers, and this section is the Attorney General’s. Where § 1798.155 gives the California Privacy Protection Agency an administrative fine assessed in its own hearing, § 1798.199.90 gives the Attorney General an injunction and a civil penalty recovered in an action brought in the name of the people of the State of California. The amounts are the same: the statute prints $2,500 per violation and $7,500 for the higher tier, and both are adjusted under § 1798.199.95(d), which names subdivision (a) of this section among the thresholds it moves, to $2,663 and $7,988 effective January 1, 2025, the amounts in force through 2026, with the next adjustment due January 1, 2027. What is not the same is the higher tier’s trigger. Section 1798.155(a) reaches an intentional violation or one involving the personal information of a consumer the business has actual knowledge is under 16; subdivision (a) here reaches each intentional violation and each violation involving the personal information of minor consumers, with no actual-knowledge element and no under-16 line drawn in the text. A court may also weigh the defendant’s good faith cooperation in setting the amount, which has no counterpart in § 1798.155(a). The two enforcers do not stack: under subdivision (c) the Agency must stay its own action or investigation at the Attorney General’s request, and under subdivision (d) the Attorney General may not sue over a violation the Agency has already decided. Subdivision (b) sends 95 percent of what the Attorney General recovers to the Attorney General Consumer Privacy Enforcement Subfund and 5 percent to the Consumer Privacy Grant Subfund, and subdivision (e) leaves the § 1798.150 private right of action untouched.

Statute text

(a) Any business, service provider, contractor, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation and each violation involving the personal information of minor consumers, as adjusted pursuant to subdivision (d) of Section 1798.199.95, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The court may consider the good faith cooperation of the business, service provider, contractor, or other person in determining the amount of the civil penalty. [...] (d) No civil action may be filed by the Attorney General under this section for any violation of this title after the agency has issued a decision pursuant to Section 1798.199.85 or an order pursuant to Section 1798.199.55 against that person for the same violation.

California Consumer Privacy Act / California Privacy Rights Act, § 1798.199.90Read the full section from California Privacy Protection Agency (CalPrivacy)