Civil Action for Damages and Injunctive Relief

What it requires

The private damages provision for the whole invasion-of-privacy chapter, § 631 included. Anyone injured by a violation may sue for the greater of $5,000 per violation or three times actual damages, may seek an injunction in the same action, and does not have to show actual damages to bring the claim. This per-violation figure is what turns a website tracking theory into class-action exposure. SB 690, signed September 30, 2026, amends this section effective January 1, 2027: a claim against a private actor under § 638.51 arising from conduct on an internet website, online application, or mobile application may be brought only by the Attorney General, including any pending claim in an action commenced within two years before that date. Claims under § 631 are unchanged. The excerpt below is the text in force until then.

Statute text

(a) Any person who has been injured by a violation of this chapter may bring an action against the person who committed the violation for the greater of the following amounts: (1) Five thousand dollars ($5,000) per violation. (2) Three times the amount of actual damages, if any, sustained by the plaintiff. (b) Any person may, in accordance with Chapter 3 (commencing with Section 525) of Title 7 of Part 2 of the Code of Civil Procedure, bring an action to enjoin and restrain any violation of this chapter, and may in the same action seek damages as provided by subdivision (a). (c) It is not a necessary prerequisite to an action pursuant to this section that the plaintiff has suffered, or be threatened with, actual damages.

California Invasion of Privacy Act, § 637.2Read the full section from California courts (private right of action under Penal Code § 637.2)