California Consumer Protection Act: CLRA, UCL, FAL, and CCPA

There is no single statute called the California Consumer Protection Act. California protects consumers through a group of overlapping laws, and the one you use depends on what the business did and what you want to recover. The four that matter most are the Consumers Legal Remedies Act (CLRA), the Unfair Competition Law (UCL), the False Advertising Law (FAL), and the California Consumer Privacy Act (CCPA).

The Consumers Legal Remedies Act

The CLRA, at Civil Code section 1750 and following, is the law most Californians will reach for when a business misleads them in a purchase.¹ It covers purchases and leases of goods and services bought for personal, family, or household use. “Goods” means physical items for personal use, including items that get permanently attached to real property like built-in appliances. “Services” means work or labor for non-commercial purposes, including services tied to selling or repairing goods.²

The CLRA protects individuals acting as consumers. If you’re buying inventory for a business or leasing commercial equipment, the CLRA does not reach the transaction. The deal doesn’t need to be a formal contract, though. Any agreement between you and a business counts, whether or not it would be enforceable on its own.²

What the CLRA Prohibits

The statute lists twenty-nine specific categories of deceptive or unfair conduct that businesses cannot use in consumer transactions.³ Among the most commonly cited:

Claiming goods have a sponsorship, approval, certification, quality, or grade they don’t actually have.
Selling used, altered, or reconditioned goods as new or original.
Advertising goods or services with no real intention of selling them as advertised.
Advertising products without intending to meet reasonably expected demand, unless the ad clearly discloses a quantity limit.
Telling you a replacement part or repair is needed when it isn’t.
Inserting unconscionable provisions into a contract.
Making false claims about the reasons for, existence of, or amount of a price reduction.

The full list also covers deceptive geographic-origin claims, misrepresenting a salesperson’s authority to negotiate final terms, and falsely suggesting a transaction creates rights or obligations that don’t actually exist.³

The 30-Day Notice You Must Send First

You cannot walk straight into court with a CLRA damages claim. At least 30 days before filing suit, you must send the business written notice by certified or registered mail with return receipt requested. Send it either to the location where the transaction happened or to the business’s main California office.⁴

The letter has to identify the specific violations and demand that the business fix the problem. If the business provides an appropriate correction, or agrees to one, within 30 days of receiving the notice, you lose the ability to sue for damages. You can still ask a court for an order stopping the practice going forward.⁴

Deadline to Sue

You have three years from the date of the deceptive act to file a CLRA claim.⁵ The clock runs from the conduct, not from when you discovered it, and the mandatory 30-day notice period comes out of the back end of that window.

What You Can Recover

If you prove a violation, available remedies include:

Actual damages. In a class action, the total award must be at least $1,000.
Punitive damages for particularly egregious conduct.
Injunctive relief ordering the business to stop the practice.
Restitution of money or property the business obtained.
Attorney’s fees and court costs, awarded to a prevailing plaintiff. Fee-shifting runs both ways: a defendant can recover reasonable fees if the court finds the suit was brought in bad faith.⁶

Seniors and consumers with disabilities can recover an additional award of up to $5,000 on top of the standard remedies. To qualify, you must show substantial physical, emotional, or economic harm, and the court must find the enhanced award warranted after weighing aggravating factors.⁶

Waivers Don’t Work

A business cannot contract its way out of CLRA liability. Any provision that purports to waive your CLRA rights is void and unenforceable as a matter of public policy.⁷ If a company’s terms and conditions say you agree not to bring a CLRA claim, that clause has no legal effect.

The Unfair Competition Law

The UCL, at Business and Professions Code section 17200, is the broadest consumer protection tool in California. It defines “unfair competition” to include any business act or practice that is unlawful, unfair, or fraudulent, along with any untrue or misleading advertising.⁸ The “unlawful” prong is especially powerful because it lets the UCL borrow violations from virtually any other state or federal law. A business that violates the CLRA, a federal consumer regulation, or an industry licensing statute has also committed unfair competition under the UCL.

To bring a private UCL claim, you must show that you actually lost money or property because of the practice.⁹ Seeing a deceptive ad or disliking a company’s behavior is not enough.

The trade-off for the UCL’s wide scope is a narrow remedy. Private plaintiffs can obtain only an order stopping the practice and restitution of money or property the business acquired.¹⁰ No compensatory damages, no punitive damages, no attorney’s fees through a private UCL action.

The deadline is four years from when the cause of action arose, one year longer than the CLRA.¹¹

The False Advertising Law

The FAL, at Business and Professions Code section 17500, prohibits spreading untrue or misleading claims about property or services through any medium when the person knows, or should know, that the statement is false.¹²

A violation is a misdemeanor punishable by up to six months in county jail, a fine of up to $2,500, or both.¹² Criminal enforcement is handled by prosecutors, not private individuals. Misleading advertising that violates the FAL also qualifies as unfair competition under section 17200, so consumers can challenge the same conduct through a civil UCL suit.

The California Consumer Privacy Act

The CCPA took effect in 2020 and was expanded by the California Privacy Rights Act. It protects personal data rather than purchasing decisions.

The CCPA applies to for-profit businesses operating in California that meet any one of three thresholds: more than $25 million in annual gross revenue; buying or selling the personal information of 100,000 or more California consumers or households per year; or earning at least half their revenue from selling personal information.¹³ Hitting any one threshold triggers the full set of obligations.

Your Rights

California residents have:

The right to know what personal information a business has collected, where it came from, why, and who it was shared with. You can make this request twice a year at no cost.
The right to delete personal information the business collected from you, with limited exceptions such as legal compliance.
The right to opt out of the sale or sharing of your personal information, including through a browser-based global privacy control.
The right to correct inaccurate personal information.
The right to limit a business’s use of sensitive data like your Social Security number, financial accounts, precise location, or genetic data.
The right not to be penalized for exercising any of these rights.¹³

When You Can Sue

The CCPA lets you sue a business directly in one situation: when your unencrypted personal information is stolen in a data breach caused by the business’s failure to maintain reasonable security practices. You can recover either your actual losses or statutory damages between $100 and $750 per consumer per incident, whichever is greater.¹⁴

Before suing for statutory damages, you must give the business 30 days’ written notice identifying which CCPA provisions it violated. If the business cures the violation and provides a written statement that no further violations will occur, statutory damages are off the table. Simply tightening security after a breach does not cure the breach that already happened. You can still sue for actual monetary damages without sending the 30-day notice first.¹⁴

Which Law Fits Your Situation

If a business deceived you in a specific purchase or service transaction, the CLRA is usually the strongest option because it offers actual damages, punitive damages, and attorney’s fees. If the conduct is broader, or doesn’t fit the CLRA’s specific prohibited categories, the UCL can reach it, though your recovery is limited to getting your money back and stopping the practice. If your personal data was compromised because a business cut corners on security, the CCPA’s private right of action is the path forward. False advertising claims are typically pursued civilly through the UCL, with criminal enforcement under the FAL left to prosecutors.

The deadlines differ, which matters when something old resurfaces. The UCL’s four-year window can carry a claim that would already be out of time under the CLRA’s three years. The CCPA has its own notice rules for data breach claims. Match the facts to the right statute before anything else, because the notice requirements and recoveries flow from that choice.

1
California Legislative Information. California Code Civil Code 1750 – Consumers Legal Remedies Act
2
California Legislative Information. California Code Civil Code 1761
3
California Legislative Information. California Code CIV 1770
4
California Legislative Information. California Code Civil Code 1782
5
California Legislative Information. California Code CIV 1783
6
California Legislative Information. California Code Civil Code 1780
7
California Legislative Information. California Code Civil Code 1751
8
California Legislative Information. California Code Business and Professions Code 17200
9
California Legislative Information. California Code Business and Professions Code 17204
10
California Legislative Information. California Code Business and Professions Code 17203
11
California Legislative Information. California Code BPC 17208
12
California Legislative Information. California Code Business and Professions Code 17500 – False Advertising in General
13
California Office of the Attorney General. California Consumer Privacy Act (CCPA)
14
California Legislative Information. California Code Civil Code 1798.150