The statute as amended by the CPRA grants access, deletion, correction, and opt-out rights, and imposes obligations on businesses meeting revenue or data thresholds. Enforcement is principally by the California Privacy Protection Agency and Attorney General.
The private right of action is limited to specified breaches.
Alternative Names:
CCPA|CPRA
Why it Matters?
The private right of action reaches only unauthorized access resulting from failure to maintain reasonable security for defined categories of unencrypted personal information, which is substantially narrower than the statute's overall scope. Claims alleging general CCPA violations without a qualifying breach fail on that basis. Statutory damages between one hundred and seven hundred fifty dollars per consumer per incident nonetheless produce substantial class exposure.
Frequently Confused with
Related terms
Frequently asked questions
How narrow is the private right of action?
What is the damages exposure?
