Under the CCPA, a business can be fined up to $2,663 per violation, or up to $7,988 per intentional violation or per violation involving a consumer it knows is under 16. People whose data is exposed in a qualifying breach can also claim $107 to $799 each in statutory damages. The largest penalty so far is the $12.75 million General Motors paid in a settlement announced on 8 May 2026, more than every earlier CCPA penalty put together.
So-called CPRA fines are the same amounts: the California Privacy Rights Act amended the CCPA rather than replacing it. As of October 2026, regulators have announced 13 public CCPA penalties against named companies, and most of them turn on the same few website failures: opt-out links that do not work, Global Privacy Control signals that are ignored and tracking that keeps running after a visitor says no.
The cost of ignoring California privacy law
California privacy law carries real financial consequences for websites that ignore visitors' rights. Regulators monitor websites and apps for failures, and they publish their settlements and fines.
The CCPA lets state authorities penalise businesses that unlawfully collect, sell or share personal information. Since the California Privacy Rights Act (CPRA) amendments, enforcement has grown more active. Companies can no longer rely on a mandatory 30-day cure period to fix mistakes after they are caught. If your website fails to honour an opt-out request or drops tracking scripts without notice, the business is exposed straight away.
Penalties scale quickly because they apply per violation. Regulators have counted violations per consumer affected, so one tracking script that ignores the opt-outs of a thousand California visitors could be pleaded as a thousand separate violations.
The focus has moved from privacy policy wording to what the website actually does.
The 2025 CPI adjustments to CCPA fines
California law requires the penalty amounts to keep pace with inflation. Under Civil Code Section 1798.199.95(d), the California Privacy Protection Agency (CPPA) adjusts them in January of every odd-numbered year, based on the Consumer Price Index (CPI), so the next adjustment is due in January 2027.
The CPPA's December 2024 adjustment took effect on 1 January 2025. The revenue threshold that makes a company a "business" under the CCPA rose from $25,000,000 to $26,625,000, and the fines and statutory damages rose in proportion.
| Violation type | Before 2025 | From 1 January 2025 |
|---|---|---|
| Administrative fine or civil penalty | $2,500 per violation | $2,663 per violation |
| Intentional violation or known minor under 16 | $7,500 per violation | $7,988 per violation |
| Statutory damages (data breach) | $100 to $750 per consumer per incident | $107 to $799 per consumer per incident |
The nature of the offence decides the tier. A genuine oversight might fall in the standard tier, but deliberately hiding opt-out mechanisms or ignoring privacy signals pushes a penalty into the intentional one. Any violation involving the data of consumers the business knows are under 16 carries the higher $7,988 maximum, whatever the intent.
Two regulators enforce the CCPA
California relies on two enforcers. At first, the California Attorney General (AG) held sole responsibility for investigating complaints and issuing penalties. That changed when voters approved the CPRA, which created the California Privacy Protection Agency, which now calls itself CalPrivacy.
The CPPA is the first dedicated privacy regulator in the United States. It can investigate websites, audit data practices and impose administrative fines directly. The Attorney General keeps civil enforcement authority and brings the cases that go to court, often with district attorneys alongside.
The two coordinate, and they work with other states. On 9 September 2025, the CPPA and the Attorneys General of California, Colorado and Connecticut announced a joint sweep of businesses that may not be processing Global Privacy Control (GPC) opt-out signals.
You cannot predict which of the two might look at your website. Both have fined companies whose cookie banners and data-sharing controls did not do what they said.
Private right of action: the cost of a data breach
Administrative fines are only one part of the exposure. The CCPA includes a limited private right of action, which lets individual consumers sue a business directly after certain security incidents.
This right applies when unencrypted and unredacted personal information is exposed because a business failed to maintain reasonable security procedures. It does not cover cookie consent failures, but it matters if data you collect through web trackers is later breached.
Statutory damages for these breaches now range from $107 to $799 per consumer, per incident. Consumers do not need to prove actual financial harm to claim them.
Class actions multiply these figures quickly. A breach exposing the records of 50,000 California residents could lead to statutory damages approaching $40 million, separate from any penalty a regulator imposes.
Every public CCPA enforcement action to date
The list below covers every CCPA penalty against a named company that the Attorney General's privacy enforcement actions page and the CPPA's announcements had published by 16 October 2026. The CPPA has also fined a series of data brokers under the Delete Act, which are left out here because they concern registration rather than websites.
| Date | Company, enforcer and penalty | What went wrong |
|---|---|---|
| 24 Aug 2022 | Sephora (AG), $1,200,000 | Sold data through trackers without saying so and ignored GPC signals |
| 21 Feb 2024 | DoorDash (AG), $375,000 | Sold customer data through a marketing co-operative without notice or an opt-out |
| 19 Jun 2024 | Tilting Point Media (AG), $500,000 | Sold children's data from a game without the required consent |
| 12 Mar 2025 | American Honda Motor Co. (CPPA), $632,500 | Asked for too much information to opt out and offered unequal privacy choices |
| 6 May 2025 | Todd Snyder (CPPA), $345,178 | A misconfigured privacy portal left opt-outs unprocessed for 40 days |
| 1 Jul 2025 | Healthline Media (AG), $1,550,000 | No working opt-out of targeted advertising and health-related article titles shared for ads |
| 30 Sep 2025 | Tractor Supply (CPPA), $1,350,000 | No effective opt-out, including for GPC signals |
| 30 Oct 2025 | Sling TV and Dish Media Sales (AG), $530,000 | A hard-to-use opt-out, missing in its apps |
| 21 Nov 2025 | Jam City (AG), $1,400,000 | No in-app opt-out and data of 13 to 15-year-olds sold without opt-in |
| 11 Feb 2026 | The Walt Disney Company (AG), $2,750,000 | Opt-outs not applied across the devices and services linked to an account |
| 3 Mar 2026 | PlayOn Sports (CPPA), $1,100,000 | An "agree" wall for tracking and opt-out preference signals ignored |
| 5 Mar 2026 | Ford Motor Company (CPPA), $375,703 | Required an email confirmation before acting on an opt-out |
| 8 May 2026 | General Motors (AG and district attorneys), $12,750,000 | Sold drivers' location and driving data to data brokers, beyond what was needed |
Every public CCPA penalty to October 2026, largest first
Read as a whole, the list shows how the cases have moved. The early settlements were about undisclosed "sales" through trackers. Many of the 2025 and 2026 cases are about friction: extra verification, an email check, a broken portal, an opt-out that covers one device but not the account.
Sephora (August 2022): the first public case
The California AG announced a $1.2 million settlement with the cosmetics retailer Sephora, the first public CCPA enforcement action. The state alleged that Sephora failed to disclose that it was selling personal information and failed to process opt-out requests sent through user-enabled GPC signals.
Under California law, making consumer data available to third parties for advertising can be a "sale" even if no money changes hands. Sephora let third-party tracking networks monitor customer behaviour but did not provide the required "Do Not Sell My Personal Information" link, and its website ignored browser-level GPC signals, which count as valid opt-out requests.
The case established that a privacy policy alone cannot protect a business whose website code keeps sharing data against visitors' wishes.
DoorDash (February 2024): a sale without money
The delivery platform DoorDash agreed to a $375,000 settlement over unlawful data sharing. The AG found that DoorDash took part in a marketing co-operative, exchanging customer names, addresses and transaction histories for advertising opportunities.
DoorDash did not tell consumers about this arrangement and offered no way to opt out. The AG rejected the argument that a co-operative was not a sale: an exchange of personal information for a commercial benefit falls under the CCPA definition. The state also noted that the violation could not be cured, because the data had already passed to downstream data brokers.
Healthline (July 2025): a banner that did not stop tracking
Healthline agreed to pay $1.55 million, then the largest CCPA settlement. The health information website did not let visitors opt out of targeted advertising and kept sharing data with some advertising partners after they had opted out.
The AG also found that Healthline shared article titles suggesting a reader had a specific diagnosed condition to target ads, beyond the purpose for which the data was collected. A consent banner suggested that unticking a box would stop tracking, but tracking cookies stayed active, which the state pursued under its Unfair Competition Law. The case shows the risk of mismanaging analytics cookies and advertising pixels, especially around sensitive topics.
General Motors (May 2026): the record
The General Motors settlement of $12.75 million is described by the Attorney General as the largest CCPA penalty in California history and its first data minimisation case. From 2020 to 2024, GM sold names, contact details, location and driving data collected through OnStar to two data brokers, while its privacy policy said it did not sell that data.
GM is not a cookie case, but the principle carries over to websites: data collected for one purpose cannot quietly be used for another.
The CPPA's own fines (2025 and 2026)
The agency's first decision, against American Honda Motor Co. in March 2025, found that Honda's online privacy management tool did not offer privacy choices in a symmetrical way and that Honda asked for too much personal information before processing opt-outs. The Tractor Supply fine of $1.35 million in September 2025 is the largest in the CPPA's history, for an opt-out that did not work for GPC signals among other failures. In March 2026, PlayOn Sports paid $1.1 million for making visitors click "agree" to tracking before they could use their tickets, and Ford paid $375,703 for asking people to confirm their email address before it would act on an opt-out.
Common technical failures that trigger investigations
Regulators do not rely on manual browsing alone. The joint GPC sweep shows they test whether websites act on the signal a browser sends.
A website is likely to draw attention if it shows any of these failures:
- Ignoring GPC: the CCPA regulations treat a GPC signal as a valid opt-out request. If a visitor arrives with GPC turned on and the site still fires advertising pixels, the opt-out has not been processed.
- Missing opt-out links: websites that sell or share data for cross-context behavioural advertising must show a clear "Do Not Sell or Share My Personal Information" link.
- Dark patterns: a consent management platform interface that makes opting out harder than opting in breaches the CCPA regulations, as Honda's fine shows.
- Friction before an opt-out: identity checks, email confirmations or extra forms before a "Do Not Sell or Share" request is honoured, the failures behind the Honda, Todd Snyder and Ford fines.
- Wrong categories: labelling third-party advertising tags as "strictly necessary" cookies to keep them out of the opt-out.
Your data collection has to match the controls you show visitors. A button that says "Reject all" must stop the scripts from running.
Short answers on CCPA fines
What is the maximum fine for a CCPA violation?
Since the adjustment of 1 January 2025, the maximum administrative fine is $2,663 for a standard violation and $7,988 for an intentional violation or any violation involving the data of consumers the business knows are under 16.
Are CPRA fines different from CCPA fines?
No. The CPRA amended the CCPA, so the same amounts apply: $2,663 per violation and $7,988 per intentional violation or violation involving a known minor under 16.
What is the largest CCPA penalty so far?
General Motors agreed to pay $12.75 million in a settlement announced on 8 May 2026, over the sale of drivers' location and driving data. The largest fine imposed by the CPPA itself is the $1.35 million it ordered Tractor Supply to pay in September 2025.
Does the CCPA 30-day right to cure still exist?
No. The CPRA amendments removed the mandatory 30-day cure period. Regulators can now issue fines without first giving the business 30 days to fix a violation.
Can individuals sue a company for CCPA violations?
Only under the private right of action, when their non-encrypted, non-redacted personal information is exposed in a data breach caused by a lack of reasonable security measures. They cannot sue under the CCPA over cookie banner issues.
Are website cookies considered a sale of data under the CCPA?
Advertising cookies that let third parties use visitor data for their own purposes or for cross-context behavioural advertising usually count as a sale or sharing, which requires an opt-out. Analytics run by a provider acting as your service provider, under a contract that limits its use of the data, usually do not.
Check what your site does before a regulator does
If your website gets traffic from California, guesswork about your tracking setup is a financial risk. Kukie.io scans your site and sorts the cookies it finds, blocks tracking scripts until visitors choose, and can honour GPC signals as an opt-out in the regions where you use an opt-out model.
