CCPA fines and settlements 2026
California announced $17.1M in CCPA fines in 2026. 12 of the 14 CCPA settlements since 2022 involved broken, missing or hard-to-use opt-outs.
CCPA Fines in 2026: Penalties and Enforcement Actions
California regulators have announced $17.1 million in CCPA fines so far in 2026, more than double the $7.9 million from every earlier year combined. If your website runs advertising or analytics tools, the pattern behind those fines is worth knowing.
We reviewed all 14 settlements announced under the California Consumer Privacy Act (CCPA) since the first case in 2022. Twelve of them involved the same underlying issue: how businesses handled people's ability to opt out of the sale or sharing of their personal data.
Below, you'll find the current CCPA penalty amounts, the 2026 settlements, a full list of every CCPA enforcement action to date, and what those cases have in common.
Key takeaways
California announced $17.1 million in CCPA fines across five settlements in 2026, through Sept. 29.
General Motors' $12.75 million settlement is the largest CCPA fine on record.
Opt-outs are the top issue: 12 of 14 CCPA settlements since 2022 involved how businesses handled opt-out requests.
CCPA penalties reach $2,663 per violation, or $7,988 per intentional violation or violation involving minors.
How much are CCPA fines in 2026?
In 2026, a CCPA fine can reach $2,663 per violation, or $7,988 per intentional violation or violation involving the personal information of consumers a business knows are under 16. CalPrivacy raised these amounts for inflation starting Jan. 1, 2025, and adjusts them every two years, with the next change due in January 2027.
Penalty type | Amount (2025 and 2026) | Who can seek it | Previous amount |
|---|---|---|---|
Administrative fine or civil penalty | Up to $2,663 per violation | Attorney General, CalPrivacy | $2,500 |
Intentional violations, or violations involving minors under 16 | Up to $7,988 per violation | Attorney General, CalPrivacy | $7,500 |
Statutory damages for certain data breaches | $107 to $799 per consumer per incident, or actual damages if greater | Consumers, through private lawsuits | $100 to $750 |
Two regulators enforce the CCPA. The California Attorney General brings cases in court, while the California Privacy Protection Agency, known as CalPrivacy, handles administrative enforcement. Of the 14 settlements to date, the Attorney General led seven, CalPrivacy brought six, and one, General Motors, was a joint action.
How CCPA penalties add up per violation
The CCPA has no overall cap on fines. Regulators count penalties per violation and can treat each affected consumer as a separate violation. If 1,000 opt-out requests were ignored and each counted as a violation, the maximum exposure would be about $2.66 million, or $7.99 million if the violations were intentional. Settlements have so far landed well below those theoretical maximums.
Is there still a cure period?
Not automatically. The original CCPA gave businesses 30 days to fix a violation after being notified, but that mandatory cure period ended on Jan. 1, 2023. Regulators can now seek penalties without first offering a chance to fix the problem.
CCPA fines and settlements in 2026
Five CCPA settlements announced in 2026 total $17,092,193, compared with $7,882,678 across the nine settlements announced from 2022 through 2025. Even without General Motors, the other four 2026 settlements average about $1.09 million, roughly a quarter more than the $875,853 average before this year.
Date | Company | Regulator | Amount | What regulators cited |
|---|---|---|---|---|
Feb 2026 | Disney | Attorney General | $2,750,000 | Opt-outs, including Global Privacy Control, did not apply across services and devices |
Mar 2026 | PlayOn Sports | CalPrivacy | $1,100,000 | Forced acceptance of tracking; ignored opt-out preference signals |
Mar 2026 | Ford | CalPrivacy | $375,703 | Extra email-verification step before processing opt-outs |
May 2026 | General Motors | Attorney General, county DAs and CalPrivacy | $12,750,000 | Sold driver data to data brokers without notice |
Aug 2026 | LocateSmarter | CalPrivacy | $116,490 | Required part of a Social Security number to opt out |
The largest CCPA fine: General Motors, $12.75 million
The largest CCPA fine on record is $12.75 million from General Motors, announced on May 8, 2026 by the Attorney General, several county prosecutors and CalPrivacy. State officials said the company sold the names, contact information, location, and driving data of hundreds of thousands of Californians to data brokers without giving notice. The settlement was subject to court approval when announced.
"Californians must have confidence that they know what data is being collected, how it is used, and what their opt-out rights are," San Francisco District Attorney Brooke Jenkins said. GM's settlement is about three-quarters of 2026's total, and it's the third time the record has fallen in under a year: Healthline set it at $1.55 million in July 2025, and Disney raised it to $2.75 million in February 2026. If you're unsure when sharing data with partners counts as a sale, see our guide to what counts as a sale or share under the CCPA.
Every CCPA settlement since 2022
Here is every CCPA settlement announced by the California Attorney General and CalPrivacy from the first case in August 2022 through Sept. 29, 2026, based on the Attorney General's privacy enforcement actions list and CalPrivacy's announcements. Amounts are as stated in each announcement. Fines only for failing to register as a data broker, which have been five-figure amounts according to the IAPP, are excluded. Each company name links to the official announcement.
Date | Company | Amount | What regulators cited |
|---|---|---|---|
Aug 2022 | $1,200,000 | Sold data through third-party trackers without telling customers; did not honor Global Privacy Control | |
Feb 2024 | $375,000 | Shared customer data through a marketing co-op without notice or a way to opt out | |
Jun 2024 | $500,000 | Mobile game collected and shared children's data without parental consent | |
Mar 2025 | $632,500 | Excessive verification for opt-outs; asymmetric cookie tool; barriers for authorized agents; missing ad tech contract terms | |
May 2025 | $345,178 | Opt-out request page broken for 40 days; required identity verification to opt out | |
Jul 2025 | $1,550,000 | Opt-outs did not stop data flowing to advertisers; shared article titles suggesting health conditions | |
Sep 2025 | $1,350,000 | Opt-out mechanism did not work and opt-out preference signals were not honored; notice and contract gaps | |
Oct 2025 | $530,000 | Hard-to-use opt-out; inadequate privacy protections for children | |
Nov 2025 | $1,400,000 | No compliant opt-out in any of 21 mobile apps; sold or shared teens' data without consent | |
Feb 2026 | $2,750,000 | Opt-outs, including Global Privacy Control, did not apply across services and devices; no in-app opt-out on connected TVs | |
Mar 2026 | $1,100,000 | Forced acceptance of tracking; misdirected opt-out requests; ignored opt-out preference signals; outdated notices | |
Mar 2026 | $375,703 | Required an extra email-verification step before processing opt-outs | |
May 2026 | $12,750,000 | Sold names, contact, location and driving data to data brokers without notice | |
Aug 2026 | $116,490 | Required part of a Social Security number to opt out; late data broker registration | |
Total | 14 settlements | $24,974,871 | – |
Car makers Honda, Ford and General Motors account for 55% of every dollar collected, but the list also includes retailers, streaming and media companies, mobile game makers, a food delivery app and a data broker.
What CCPA enforcement actions have in common
Opt-outs are where a privacy policy meets how a website really behaves. Twelve of the 14 CCPA settlements involved how a business handled requests to opt out of the sale or sharing of personal data, by far the most common issue regulators have cited. "Opting out is supposed to be easy," CalPrivacy's head of enforcement, Michael Macko, said of the Ford case.
Enforcement issue | Examples |
|---|---|
No working opt-out | Sephora, DoorDash, Jam City, Tractor Supply |
Unnecessary friction | Honda, Todd Snyder, Ford, LocateSmarter |
Ignored Global Privacy Control | Sephora, Tractor Supply, PlayOn Sports, Disney |
Opt-out doesn't carry across devices or partners | Disney, Healthline |
Asymmetric or forced choices | Honda, PlayOn Sports |
Children's and teens' data | Tilting Point Media, Sling TV, Jam City |
No working opt-out. Jam City had no compliant opt-out across 21 apps, and DoorDash offered none for its marketing co-op. See our guide to handling CCPA opt-out requests for the requirements.
Unnecessary friction. Todd Snyder, Ford, and LocateSmarter added identity checks, email confirmations, or Social Security digits to opt-outs. Our CCPA verification dos and don'ts explain where verification belongs.
Ignored Global Privacy Control. Regulators have cited GPC failures since 2022, including in a joint three-state sweep. See our guide to Global Privacy Control for when you need to honor the signal.
Opt-outs that don't travel. Disney's opt-outs stopped at individual services and devices, and Healthline's didn't stop data reaching advertisers.
Asymmetric or forced choices. Honda made declining harder than accepting, and PlayOn Sports made tracking a condition of use. See the CCPA symmetry rule.
Children's and teens' data. Selling or sharing data from consumers under 16 requires opt-in consent. We covered the Tilting Point final judgment in detail.
What CCPA enforcement means for your business
These cases aren't limited to big tech. Any covered business that sells or shares California visitors' personal data, including through ordinary advertising tools on a website or app, has to offer a working opt-out and honor it. The law generally applies to for-profit businesses doing business in California that meet at least one threshold, such as annual revenue above $26,625,000. Our CCPA applicability guide lists them all.
Recent enforcement shows that having privacy controls in place isn't enough. Regulators are examining whether those controls work when someone tries to opt out or when a browser sends an opt-out preference signal. For the broader requirements, see our CCPA compliance guide for businesses. For how similar gaps show up in other enforcement actions, see our roundup of 2026 privacy enforcement failures.
How Clym supports your CCPA opt-out setup
Many of the enforcement issues in these settlements came down to a gap between what a business said about privacy choices and how its website or app behaved in practice. Clym helps you manage that gap:
Opt-out and GPC controls: manage "Do Not Sell or Share" workflows and equal-choice banners with Clym's consent management platform, and honor Global Privacy Control signals automatically.
Tracker control: identify third-party services with the cookie scanner and control tags based on each visitor's choice.
Requests and records: manage privacy requests, deadlines and consent records with data subject request management.
Age-based experiences: apply age gating and the right consent flows for younger users.
Clym doesn't replace legal advice, and no tool can guarantee how a regulator will view your setup. It does make it easier to check that your opt-outs work as your site changes.
Conclusion
CCPA enforcement in 2026 shows that having privacy controls in place isn’t enough. Businesses need to ensure opt-outs, Global Privacy Control signals, and other privacy choices work as intended. Regularly testing these controls can help identify gaps before they become enforcement issues.
Frequently asked questions
Regulators can seek up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors under 16. Consumers can also sue for $107 to $799 per person per incident after certain data breaches. Because penalties are counted per violation, one broken opt-out affecting many people can add up quickly.
The maximum is $7,988 per intentional violation for 2025 and 2026, up from $7,500 before CalPrivacy's inflation adjustment. The same amount applies to violations involving personal information of consumers a business knows are under 16. There is no overall cap, so the total depends on how many violations regulators count.
The largest CCPA fine is $12.75 million from General Motors, announced on May 8, 2026, by the California Attorney General, county prosecutors, and CalPrivacy. Officials said GM sold drivers' names, contact information, location, and driving data to data brokers without notice. It passed Disney's $2.75 million record from February 2026.
Consumers can file a complaint with CalPrivacy through the complaint form on its website, or with the California Attorney General's office. Useful details include the business name, the website or app, what you tried to do (such as opting out), and screenshots. Regulators use these complaints to spot patterns and choose investigations.
Yes. Opt-out failures are the most common issue in CCPA enforcement: 12 of the 14 settlements announced since 2022 involved how a business handled requests to opt out of the sale or sharing of personal data. Ford paid $375,703 in 2026 for adding an unnecessary verification step before processing opt-outs.
Yes. Under the CCPA regulations, businesses that sell or share personal information must treat a Global Privacy Control signal as a valid opt-out request. Ignoring GPC has been cited in several settlements, starting with Sephora in 2022, and California, Colorado, and Connecticut ran a joint sweep on GPC compliance in 2025.
Michael Williams
Chief Financial Officer
Michael is an experienced C-suite executive who has spent his career guiding organizations through an ever-evolving regulatory landscape. After starting his career at Ernst & Young, Michael worked as a CFO with large, global organizations before co-founding Clym to assist organizations of all sizes with their website regulatory compliance needs.
