California Data Security Law: Duties, Rights, and Penalties

California’s data security law — the California Consumer Privacy Act, as amended by the California Privacy Rights Act — requires covered businesses to protect California residents’ personal information with reasonable security, honor a defined set of consumer rights over that information, and limit collection and retention to what is actually needed. Violations can bring administrative fines of up to $7,500 per incident, and consumers whose unencrypted personal information is exposed in a breach caused by inadequate security can sue for $100 to $750 per person.¹

Which Businesses Are Covered

The law reaches for-profit businesses that do business in California and meet at least one of three thresholds:²

Annual gross revenue above $25 million as of January 1 of the calendar year. Adjusted for inflation, the current figure is $26,625,000.³
Buying, selling, or sharing the personal information of 100,000 or more consumers or households each year.
Deriving 50 percent or more of annual revenue from selling or sharing consumers’ personal information.

Entities sharing common branding with a qualifying business and receiving consumer data from it are also pulled in, as are joint ventures in which each partner holds at least a 40 percent interest.²

Reasonable Security Duty

California Civil Code Section 1798.81.5 requires every business that owns, licenses, or maintains personal information about a California resident to implement and maintain reasonable security procedures appropriate to the nature of the information. The statute does not list specific controls. The standard scales with the sensitivity of the data.⁴

When a business hands personal information to a third party, it must require that third party by contract to maintain the same reasonable security standards. This matters because the breach lawsuit right under the CCPA turns on whether the business violated its reasonable-security duty. A breach by itself does not trigger liability. The breach has to result from a security failure that fell below the “reasonable” bar.⁵

Consumer Rights You Must Honor

Covered businesses must respond to verified consumer requests and must explain these rights in their privacy notices.¹

Right to know what categories and specific pieces of personal information the business has collected, where it came from, why it was collected, and which third parties received it.
Right to delete personal information and direct service providers to do the same. The business may refuse in limited circumstances, such as a legal obligation to retain the data, but must explain any denial.
Right to correct inaccurate personal information, added by the CPRA effective January 1, 2023. The business must use commercially reasonable efforts.⁶
Right to opt out of the sale or sharing of personal information. The CPRA expanded this to cover “sharing” for cross-context behavioral advertising, not just sales for money.
Right to limit use of sensitive personal information to what is necessary to provide the requested goods or services.
Right to non-discrimination for exercising any of these rights. No denial of service, higher prices, or lower quality.

Opt-Out Mechanics

Businesses that sell or share personal information must place a clear, conspicuous homepage link titled “Do Not Sell or Share My Personal Information.” Businesses that also use sensitive personal information beyond what is needed to fulfill a request must add a second link: “Limit the Use of My Sensitive Personal Information.”¹

Browser-based Global Privacy Control signals must be honored. Under California law, a GPC signal functions as a valid request to stop selling or sharing that consumer’s personal information.⁷

Sensitive Personal Information

The CPRA carved out a distinct category of “sensitive personal information” with heightened protections. Once a consumer sends a request to limit use, the business must stop using that data for any purpose beyond fulfilling the consumer’s transaction unless the consumer later consents to additional purposes.⁸ The category includes:⁹

Government identifiers: Social Security, passport, driver’s license, and state ID numbers.
Account log-in credentials combined with access codes or passwords.
Precise geolocation.
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership.
The contents of emails, texts, and other private messages not directed to the business.
Biometric, genetic, and neural data.
Health information, sex life, and sexual orientation.

Data Minimization and Retention

The CPRA added a proportionality standard. A business’s collection, use, retention, and sharing of personal information must be reasonably necessary and proportionate to the purposes for which the data was collected or another compatible, disclosed purpose. Processing beyond what a consumer would reasonably expect is not permitted.¹⁰

Retention criteria have to appear in the privacy policy, and specific retention periods or the criteria for setting them must appear in the notice at collection. Collecting everything and sorting it out later is no longer defensible. Holding data you do not need creates legal and enforcement exposure.

Penalties for Non-Compliance

Administrative Fines

The California Privacy Protection Agency can impose fines of up to $2,500 per violation. Intentional violations, or violations involving the personal information of a consumer the business knows is under 16, carry fines of up to $7,500 per violation. Both amounts adjust periodically for inflation.¹¹

Fines run per violation, not per enforcement action. A business that mishandles opt-out requests for thousands of consumers faces a calculation that multiplies by each affected person, and that math escalates quickly.

Private Right of Action for Breaches

Consumers can sue when their unencrypted, unredacted personal information is exposed in a breach caused by the business’s failure to maintain reasonable security. Statutory damages range from $100 to $750 per consumer per incident, or actual damages, whichever is greater. Courts weigh the seriousness of the misconduct, the number of violations, how long it persisted, and the business’s financial position.⁵

Before filing for statutory damages, a consumer must give the business 30 days’ written notice identifying the provisions they believe were violated. If the business actually cures the violation within that window and provides a written statement that it will not recur, the consumer cannot pursue statutory damages for that breach. Installing new security measures after a breach does not count as a cure for the breach itself. And if the business later violates its written assurance, the consumer can sue to enforce it and recover damages for every subsequent violation.⁵

Who Enforces the Law

The CPRA created the California Privacy Protection Agency, which took over rulemaking authority from the Attorney General and can bring administrative enforcement actions, conduct audits, and issue interpretive regulations. The Attorney General retains independent enforcement authority.¹²

One shift matters more than the others: the CPRA eliminated the mandatory 30-day cure period that previously applied to enforcement. Under the original CCPA, the Attorney General had to give businesses 30 days to fix a violation before pursuing penalties. That safety net is gone. The CPPA has discretion to allow a cure period and may consider lack of intent and voluntary remediation, but no window is guaranteed. If you discover a compliance gap, act on it rather than waiting for a notice.

What the Law Does Not Cover

Two federal frameworks keep certain data outside most of the CCPA:¹³

Protected health information held by a HIPAA-covered entity or business associate under HIPAA’s privacy, security, and breach notification rules is exempt. So is medical information governed by California’s Confidentiality of Medical Information Act.
Personal information collected, processed, sold, or disclosed under the federal Gramm-Leach-Bliley Act or California’s Financial Information Privacy Act is exempt. One catch: this exemption does not extend to the private right of action for breaches under Section 1798.150. A financial institution with GLBA-covered data can still face consumer lawsuits for statutory damages if a breach stems from inadequate security.

These exemptions apply at the data level, not the entity level. A hospital’s HIPAA-governed patient records are exempt, but its gift-shop loyalty program data is not.

Employee and business-to-business data used to be exempt as well. Those temporary exemptions expired on December 31, 2022. Since January 1, 2023, personal information about employees, job applicants, contractors, their emergency contacts, and B2B counterparts is fully subject to the law. Businesses have to provide CCPA disclosures to their own workforce, honor deletion and correction requests from employees and applicants, and apply the same minimization standards to HR data that apply to customer data.¹

1
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
2
California Legislative Information. California Civil Code 1798.140
3
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
4
California Legislative Information. California Civil Code CIV 1798.81.5
5
California Legislative Information. California Civil Code 1798.150
6
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.106
7
State of California – Department of Justice – Office of the Attorney General. Global Privacy Control (GPC)
8
California Legislative Information. California Civil Code CIV 1798.121
9
California Privacy Protection Agency. What Is Personal Information?
10
California Privacy Protection Agency. Applying Data Minimization to Consumer Requests
11
California Legislative Information. California Civil Code 1798.155
12
California Legislative Information. California Civil Code 1798.185
13
California Legislative Information. California Civil Code 1798.145