What damages can I recover for a data breach under CCPA?

What the Law Says

The California Consumer Privacy Act (CCPA) provides a limited private right of action for consumers whose nonencrypted and nonredacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure due to a business’s failure to implement reasonable security procedures.

This right only applies to specific types of personal information listed in California Civil Code § 1798.81.5(d)(1)(A), such as Social Security numbers, driver’s license numbers, medical information, or financial account credentials — but not email addresses alone or anonymized data.

To qualify, the breach must result from the business’s violation of its duty to implement and maintain reasonable security procedures appropriate to the nature of the information. The law does not define 'reasonable security' but looks at industry standards, size of the business, and sensitivity of data.

You cannot sue under the CCPA for every privacy violation — only for qualifying data breaches that meet these strict conditions. Other CCPA enforcement is handled exclusively by the California Privacy Protection Agency (CPPA).

Statutory Text

Any consumer whose nonencrypted and nonredacted personal information… is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices… may institute a civil action…

— Cal. Civ. Code § 1798.150(a)(1) — Private right of action

Statutory Text

…for damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty dollars ($750) per consumer per incident, or actual damages, whichever is greater…

— Cal. Civ. Code § 1798.150(a)(1)(A) — Damages

Sources