Clym Logo

CCPA Penalties and Fines in 2026: How Much Is a CCPA Violation?

~ 7 min read

CCPA Penalties and Fines: What Businesses Need to Know

The California Privacy Protection Agency (CPPA) has introduced a revised CCPA fine structure effective in 2025, adjusting penalty amounts for inflation and clarifying how enforcement actions are assessed. The update creates tiered categories for negligent, intentional, and minor-related violations, offering greater transparency and proportionality in how businesses are fined. This article explores the new fine amounts, real-world cases, and enforcement priorities for 2025–2026, along with practical steps companies can take to reduce exposure and strengthen privacy operations under California’s evolving data protection framework.

Summarize full article with:

The California Consumer Privacy Act (CCPA) is California’s primary data privacy law, granting residents rights over how their personal information is collected, used, and shared by businesses. If you are unsure whether the law applies to your organization, start with our CCPA applicability guide.

On December 17, 2024, the California Privacy Protection Agency (CPPA) announced inflation-based adjustments to certain monetary thresholds under the CCPA. These updated amounts take effect on January 1, 2025. Under California Civil Code §1798.199.95(d), penalty and statutory damage thresholds are periodically adjusted in odd-numbered years based on the Consumer Price Index (CPI).

Many businesses seek to find out the exact value of CCPA penalties, or CCPA fines, in order to understand their potential financial exposure. Organizations evaluating these risks should also review the broader requirements explained in our CCPA compliance guide for businesses, which outlines operational steps companies typically implement when managing CCPA obligations. Under California law, CCPA fines are assessed on a per-violation basis. This means that even a single compliance gap affecting thousands of consumers can multiply into significant CCPA penalties.

In this article we look at how CCPA fines, penalties, and enforcement actions work, what counts as a CCPA violation, how CCPA penalties are calculated per violation, when statutory damages apply, and how enforcement authorities determine the final CCPA fine amount.


Why the CCPA fine system changed in 2025: Updated penalty structure explained

Before 2025, the CCPA set maximum penalty caps, $2,500 for general violations and $7,500 for intentional or child-related violations, but it did not specify how those amounts should be applied or adjusted over time. This often left regulators with broad discretion and businesses uncertain about their potential exposure.

The 2024 CPPA notice did not change the underlying structure of CCPA penalties. Instead, it updated the statutory monetary thresholds to reflect inflation. Under the law, regulators may impose administrative fines of up to a specified amount per violation, and those thresholds are periodically adjusted to maintain their deterrent value.

As a result, businesses tracking CCPA penalties must monitor both statutory updates and inflation-based adjustments to understand the current maximum CCPA fine per violation.

While the statute establishes maximum penalties per violation, regulators retain discretion when determining enforcement actions. In practice, authorities may consider factors such as the scope of the violation, the number of affected consumers, the business’s response to the issue, and whether corrective steps were taken.

The framework aims to:

  • Replace ambiguity with predictable fine ranges for similar violations.
  • Emphasize proportionality by considering both business behavior and harm caused.
  • Encourage organizations to act proactively and document privacy governance efforts.

For example, consider a digital marketing company that collects and sells consumer data without providing a clear opt-out link or properly disclosing third-party data sharing. To understand when such practices qualify as selling or sharing, review our article on what counts as selling or sharing under CCPA. Before the 2025 inflation adjustment, the statutory maximum penalties were $2,500 per violation and $7,500 for intentional violations or violations involving consumers under 16 years of age. The 2025 CPI adjustment increased those thresholds to $2,663 and $7,988 respectively, with the possibility of additional damages of $107–$799 per affected consumer.


CCPA fines and penalties 2026: Updated amounts and tiers explained

Under Cal. Civ. Code § 1798.155 and § 1798.199.90, the following fine amounts apply from January 1, 2025 and continue through 2026 unless adjusted for inflation.

Type of violation

Maximum fine (2026)

Details

General (non-intentional) violation

$2,663 per violation

Regulators may treat violations affecting multiple consumers as separate violations depending on the circumstances of the case.

Intentional violation

$7,988 per violation

Covers reckless or knowing conduct that disregards CCPA duties.

Violation involving minors (<16 years)

$7,988 per violation

Applies to intentional violations and violations involving personal information of consumers the business has actual knowledge of are under 16 years of age.

Individual consumer damages

$107 – $799 per consumer per incident or actual damages

Consumers may seek compensation through civil action.

These figures represent the CCPA maximum fine levels as of 2025. The CPPA will review these thresholds again in 2027 to reflect future CPI changes. Under the CCPA, each affected consumer may count as a separate violation. Because CCPA fines are calculated per violation, total exposure depends on the number of impacted individuals, not just the type of misconduct.


How much are CCPA fines per violation?

The CCPA authorizes the CPPA and Attorney General to issue civil and administrative fines for non-compliance. In 2026, the maximum CCPA fine per violation is $2,663 for unintentional violations and $7,988 for intentional or minor-related violations. These amounts represent administrative CCPA penalties imposed by regulators. Because violations may be counted per consumer, CCPA fines can increase rapidly in high-volume data environments. In addition, consumers affected by data breaches may seek damages between $107 and $799 per incident or actual damages, whichever is higher. The amount of each CCPA penalty depends on the nature, intent, and scope of the violation.

How regulators calculate CCPA penalties

Regulators evaluate several factors when determining the final amount of CCPA penalties in an enforcement action. While the statute sets maximum fine amounts per violation, the final CCPA fine often reflects how the violation occurred and how the business responded.

Authorities such as the California Privacy Protection Agency (CPPA) and the California Attorney General typically consider:

  • Number of affected consumers: Because CCPA fines are calculated per violation, large datasets or high‑traffic platforms can significantly increase total exposure.
  • Intent or negligence: Intentional violations typically result in higher CCPA penalties than accidental or promptly corrected issues.
  • Duration of the violation: Ongoing failures to provide opt‑out mechanisms or honor consumer requests may increase enforcement risk.
  • Remediation efforts: Businesses that quickly correct issues and cooperate during investigations may see reduced penalties.
  • Impact on consumers: Regulators may evaluate whether the violation caused harm or exposed sensitive personal information.

For example, if a company ignores opt‑out requests from 10,000 consumers, regulators could theoretically assess CCPA fines for each affected individual. Even at the lower penalty tier, per‑violation fines can accumulate quickly in large‑scale data operations.


CCPA penalty tiers: How California calculates fines under the enforcement model

The CPPA applies structured penalty tiers that consider intent, harm, repetition, and cooperation.

Tier

Description

Base penalty

1

Minor violations with low harm and high cooperation

$2,500

2

Low harm with no prior violations, some negligence

$7,500

3

Moderate harm, standard negligence

$15,000

4

High harm, repeated violations, or recklessness

$22,500

5

High harm with wilful misconduct

$30,000

6

Severe, repeated violations with clear intent to deceive or cause harm

$50,000

These enforcement tiers illustrate how regulators assess CCPA penalties beyond the base fine amount. While the statute sets maximum CCPA fines, the final penalty depends on intent, repetition, harm, and cooperation during investigation.

Mitigating factors, such as documented staff training, transparent cooperation, and timely consumer notification, may reduce exposure within these tiers.


What qualifies as a CCPA violation: Common examples and scenarios

Common violations include:

Example of a CCPA violation:
A retail website tracks visitors for advertising without providing an opt-out link. Each user session where data is sold or shared could count as an individual CCPA violation fine.

Each of these scenarios may trigger administrative CCPA penalties if regulators determine that the business failed to meet statutory obligations. Many enforcement actions originate from mishandled consumer requests, which is why companies often implement structured workflows. In large-scale digital operations, repeated failures can result in substantial CCPA fines.


CCPA enforcement actions and settlements: Key court cases and outcomes

California’s privacy law is enforced through a shared model, allowing both the California Attorney General and the California Privacy Protection Agency (CPPA) to pursue investigations and impose penalties. This dual enforcement approach ensures that businesses remain accountable under both administrative and legal oversight.
Key CCPA enforcement actions and outcomes

  • Sephora (2022) - paid $1.2 million in civil penalties and agreed to injunctive terms after the Attorney General found the company failed to disclose that it sold personal information, did not honor Global Privacy Control signals, and did not cure within the required period. The judgment required updated privacy disclosures, honoring GPC signals, service-provider contract corrections, and periodic reporting.
  • DoorDash (2024) - paid a $375,000 civil penalty and accepted permanent injunctive terms after an investigation concluded it participated in a marketing cooperative that shared customer data without adequate notice or an opportunity to opt out. The settlement required updated privacy notices, contract reviews with marketing vendors, and annual reports on sale or sharing practices.
  • People v. Sling TV (2025) - resulted in a stipulated judgment and permanent injunction focused on accurate disclosures and honoring opt-out rights for cross-context behavioral advertising. The order required enhanced privacy notices, clarity around data related to minors, and compliance certifications to the Attorney General; resulted in a $530,000 settlement and permanent injunction requiring clearer privacy disclosures and improved opt-out handling for advertising data practices.

Enforcement priorities signaled for 2025

  • Misleading consent interfaces and other dark pattern practices.
  • Retention beyond disclosed business purposes and insufficient purpose limitation.
  • Children and teens’ data, advertising transparency, and opt-out signals.

CCPA investigation process


CCPA From Violation to Enforcement


CCPA enforcement investigations: common violation scenarios

California’s privacy law is enforced through a shared model, allowing both the California Attorney General and the California Privacy Protection Agency (CPPA) to pursue investigations and impose penalties.

CCPA enforcement penalties may be issued by either the California Attorney General or the CPPA. Both authorities have the power to investigate violations, conduct audits, and impose administrative CCPA fines.

Recent public enforcement actions have emphasized:

  • Failure to disclose selling or sharing practices
  • Failure to honor Global Privacy Control signals
  • Inadequate opt-out mechanisms
  • Weak service-provider agreements

Regulators increasingly examine backend data practices, not only website disclosures.


Recent enforcement examples and potential penalty exposure

Scenario

Example violation

Potential regulatory response

Failure to honor opt‑out signals

Ignoring Global Privacy Control signals

Administrative CCPA penalties and required remediation

Undisclosed data sharing

Selling consumer data without disclosure

Higher tier CCPA fines and corrective orders

Mishandled consumer requests

Ignoring verified deletion requests

Investigation and per‑consumer penalties

Inadequate service‑provider agreements

Vendors using consumer data beyond disclosed purposes

Regulatory audit and possible enforcement penalties

These enforcement examples illustrate how operational failures can translate into administrative CCPA fines when regulators determine that statutory obligations were not followed.

CCPA fines vs statutory damages: understanding the difference

Businesses often confuse regulatory CCPA fines with consumer statutory damages. The two operate differently and may apply simultaneously depending on the incident.

Category

Who imposes it

Amount

When it applies

Administrative CCPA penalties

CPPA or California Attorney General

Up to $2,663 or $7,988 per violation

Violations of CCPA obligations such as opt‑out failures or notice violations

Statutory damages

Consumers through civil lawsuits

$107–$799 per consumer per incident

Certain data breaches caused by inadequate security practices

Understanding this distinction helps organizations evaluate their potential exposure under different enforcement scenarios.

Statutory damages and private right of action

Under §1798.150, consumers may bring civil actions when certain data breaches occur due to failure to implement reasonable security measures. Statutory damages range from $107 to $799 per consumer per incident, or actual damages if higher.

These statutory damages are separate from administrative CCPA penalties. In certain cases, businesses may face both regulatory CCPA fines and private civil claims if a qualifying data breach occurs.

CCPA penalties and enforcement in 2026: What businesses should expect

As California’s privacy framework continues to evolve, 2026 reflects a period of operational enforcement.

While the per-violation CCPA fine amounts remain stable through 2026, enforcement attention continues to expand into consent design, data retention, opt-out symmetry, and transparency obligations. Businesses evaluating CCPA penalties exposure should review both statutory fine levels and operational risk factors using a structured CCPA compliance guide for businesses.

Areas of focus include:

  • Honoring opt-out preference signals (including GPC)
  • Symmetry between consent and opt-out mechanisms
  • Clearer cookie banner disclosures
  • Expanded privacy policy transparency
  • Youth and teen data protections

Penalty amounts

  • The California Privacy Protection Agency (CPPA) adjusts monetary thresholds in odd-numbered years based on CPI, as stated in California Civil Code § 1798.100 et seq.. Given the December 17, 2024 notice, the 2025 amounts are expected to remain in place through 2026, with the next update scheduled for 2027. Current levels: $2,663 per violation and $7,988 per intentional or minors-related violation; consumer damages $107–$799 per incident.

Regulations effective January 1, 2026

  • The CPPA announced on September 23, 2025 that the Office of Administrative Law (OAL) approved a package of new and revised regulations, effective January 1, 2026. Key public-facing items include: confirming honored opt-out requests (including GPC), symmetry in consent and opt-out steps, clearer cookie banner requirements, expanded privacy policy disclosures (including categories disclosed to service providers and contractors), and a required privacy policy link in mobile app settings.
  • Additional timing applies for some areas. Risk assessment duties begin January 1, 2026 with attestations due starting in 2028. Automated decision making technology obligations take effect January 1, 2027. Cybersecurity audit schedules are phased based on revenue, with certifications beginning in 2028.

Enforcement focus areas in 2026

  • Adoption of the 2026 regulation changes on websites and apps, including honoring opt-out preference signals and avoiding non-symmetrical consent designs.
  • Privacy policy placement and content updates, including app settings links and service provider disclosures.
  • Ongoing attention to youth privacy and advertising transparency.

Practical takeaway

  • For planning, treat 2026 as the year to operationalize the revised rules while keeping the 2025 CCPA maximum fine amounts in mind. Public-facing updates, consent flows, and signal handling are likely to be central in reviews and investigations.

6 steps to prepare your organization for CCPA enforcement in 2026

Six steps to reduce your CCPA risk

These steps help demonstrate good-faith efforts if regulators evaluate CCPA enforcement penalties.

How to report a CCPA violation to the CPPA

Consumers and organizations may file complaints through the CPPA online portal, which allows the public to report CCPA violation cases directly to the California Privacy Protection Agency. Complaints can relate to issues such as missing opt-out options, inaccurate privacy disclosures, or improper handling of consumer requests.
Once submitted, the CPPA may review the complaint, determine whether it indicates a pattern of non-compliance, and, if necessary, coordinate with the California Attorney General’s Office for further investigation. The agency’s published guidance clarifies that it focuses on patterns of misconduct and may use collected reports to inform future enforcement priorities.

How businesses can reduce the risk of CCPA penalties and fines

  1. Map data flows: identify what categories of personal information are collected and shared.
  2. Update privacy notices: state business purposes and retention periods clearly.
  3. Establish consumer request workflows: log each access, deletion, or opt-out request.
  4. Review vendor contracts: confirm that third parties meet service-provider obligations.
  5. Train employees: educate staff on timelines, consumer rights, and reporting processes.
  6. Document remediation efforts: records showing good-faith actions may reduce penalties.

To implement these steps systematically and avoid missing any requirements, use our step-by-step CCPA Compliance Checklist.

How Clym helps businesses manage CCPA penalties and privacy obligations

Navigating California’s privacy rules requires reliable tools that simplify consent management, consumer rights handling, and documentation. Clym offers a unified platform that helps organizations address the operational side of privacy management with solutions built to support CCPA and similar frameworks.

Clym’s integrated approach helps businesses simplify the complex regulatory landscape while maintaining transparency and respecting consumer rights.

FAQs about CCPA penalties

In 2026, the maximum CCPA fine is $2,663 per unintentional violation and $7,988 per intentional or minor-related violation. These are administrative CCPA penalties imposed by regulators and are calculated on a per-violation basis.

Consumers may seek statutory damages of $107–$799 per incident in certain data breach cases under §1798.150.

Consumers may claim $107 – $799 per incident or actual damages, whichever is higher, under the CCPA’s private right of action. This provision applies to certain data breaches involving unencrypted or unredacted personal information. The law also allows courts to consider the nature and severity of the breach when assessing damages, providing flexibility in how consumer harm is compensated.

Yes. The law applies to businesses meeting specific thresholds, such as annual revenue over $25 million, buying or selling data of 100,000 or more consumers, or deriving 50% or more of revenue from selling or sharing personal data. Smaller entities outside these thresholds are generally not covered but may still face enforcement under other consumer protection statutes.

Yes. Each affected consumer may count as a separate violation. This per-consumer structure means CCPA penalties and fines are volume-driven, and exposure often depends on how many individuals are impacted.

The California Privacy Protection Agency (CPPA) and the Attorney General share enforcement authority. The Attorney General continues to bring civil actions in state court, while the CPPA leads administrative enforcement, audits, and rulemaking. This shared framework allows for both preventive oversight and formal enforcement when violations are found.

Violations may include failing to display a “Do Not Sell or Share My Personal Information” link, ignoring verified deletion requests, collecting sensitive personal data without disclosure, or sharing user data with third parties without consent. For instance, the Attorney General’s case against Sephora showed that failing to honor Global Privacy Control signals could qualify as a CCPA violation.

Clym cannot guarantee immunity from enforcement, but it provides features that help organizations manage data privacy and documentation effectively. Through its centralized dashboard, consent logs, and data request workflows, businesses can demonstrate their ongoing efforts to maintain compliance readiness.

The California Privacy Protection Agency (CPPA) is required by law to adjust penalty amounts every two years based on the Consumer Price Index (CPI). The next scheduled review is in 2027, meaning the 2025 fine levels remain in effect through 2026. These periodic updates help maintain fairness and deterrence by reflecting economic changes.

Consumers have several key rights, including the right to know what personal information is collected, the right to delete that information, the right to opt out of its sale or sharing, and the right to correct inaccurate data. They also have the right to access a copy of their personal data and to request that businesses disclose their data-sharing practices.

Under the CCPA, businesses generally have 45 days to respond to a verified consumer request. This period may be extended by an additional 45 days when reasonably necessary, provided the consumer is informed of the extension and its justification. Proper request-handling documentation helps demonstrate good-faith compliance efforts.

Companies can reduce risk by maintaining clear privacy notices, updating consent interfaces to reflect current requirements, and tracking all consumer requests for access or deletion.

Using tools such as Clym’s Consent Management Platform and Data Subject Request Management can simplify these processes and improve transparency.

The statute sets maximum amounts per violation but does not establish a total aggregate cap. Because fines are calculated per violation, total CCPA penalties can increase significantly depending on the number of affected consumers.

CCPA penalties are administrative fines imposed by regulators. Statutory damages are amounts consumers may seek in certain data breach cases. A business may face both depending on the circumstances.

Intentional misconduct, repeated violations, failure to honor opt-out signals, mishandling of minors’ data, and lack of cooperation during investigations can all increase exposure under the CCPA penalty framework.

Alex Margau

Content Manager

Alex is a Content Developer at Clym, where he researches and writes about everything related to data privacy and web accessibility compliance for businesses, helping them stay informed on their compliance needs and spreading awareness about making the web safer and more inclusive. When he’s not writing about compliance, Alex has his nose in a book or is hiking in the great outdoors.

Find out more about Alex

Related articles