Your Rights Under CCPA: What California Residents Know

California has the strongest consumer data privacy law in the United States. If you are a California resident who received a data breach notification letter, the California Consumer Privacy Act (CCPA) gives you rights that go beyond what federal law provides — including the right to sue for statutory damages even if you cannot prove actual financial harm. Here is what you need to know.

What Is the CCPA?

The California Consumer Privacy Act, which took effect on January 1, 2020, and was significantly expanded by the California Privacy Rights Act (CPRA) in 2023, is the most comprehensive state consumer privacy law in the country. It applies to for-profit businesses that collect personal information from California residents and meet certain revenue or data-volume thresholds.

For data breach purposes, the most important provision of the CCPA is its private right of action — the ability of individual consumers to sue companies directly when certain categories of their personal data are exposed due to a company's failure to maintain reasonable security.

The CCPA Private Right of Action: What It Means for You

Unlike most federal privacy laws, which are enforced only by government agencies, the CCPA allows individual California residents to file a lawsuit when their sensitive personal information is breached. This right is not dependent on proving that you suffered actual financial harm — the statute provides for damages even where harm is "not readily quantifiable."

Statutory Damages

Under the CCPA, California consumers can seek statutory damages of:

$100 to $750 per consumer, per incident — even without proof of actual harm
OR the amount of actual damages if they exceed $750

Whichever is greater is the standard. In a breach affecting one million California residents, the potential statutory liability ranges from $100 million to $750 million — before any actual damages are considered. This creates enormous negotiating leverage in settlement discussions.

What Types of Data Are Covered?

The CCPA's private right of action is triggered by the unauthorized access, exfiltration, theft, or disclosure of specific categories of sensitive personal information. These include:

Social Security numbers
Driver's license or ID card numbers
Account login credentials (username/email combined with a password or security question)
Financial account numbers combined with security codes or passwords
Medical or health insurance information
Biometric data
Genetic data
Precise geolocation data

If your data breach notification letter references any of these categories, you likely have a viable CCPA claim as a California resident.

The "Reasonable Security" Standard

The CCPA requires businesses to implement "reasonable security procedures and practices appropriate to the nature of the personal information." When a breach occurs, there is an implied failure to meet this standard — placing the burden on the company to demonstrate its security was adequate, not on you to prove it was inadequate.

Courts have looked to guidance from the California Attorney General's office and the Center for Internet Security (CIS) Controls as benchmarks for what "reasonable security" means. Failure to implement basic safeguards like encryption, multi-factor authentication, and regular access audits has supported liability findings in prior cases.

The 30-Day Cure Period

Before filing a CCPA data breach lawsuit, consumers must provide written notice to the business identifying the alleged violations and giving the company 30 days to "cure" the violation. In the data breach context, this typically means notifying the company of the breach and the claimed damages before filing suit.

An attorney handles this notice requirement on your behalf. It is a procedural step, not a barrier — many companies choose to enter settlement negotiations during this period rather than await formal litigation.

CCPA Rights Beyond Data Breach

California residents have additional rights under the CCPA that are separate from breach claims but worth knowing:

Right to know what personal information a business has collected about you
Right to delete your personal information held by a business (with limited exceptions)
Right to opt out of the sale or sharing of your personal information
Right to correct inaccurate personal information
Right to limit use of sensitive personal information
Right to non-discrimination for exercising any of these rights

Frequently Asked Questions

Does the CCPA apply if the breached company is not based in California?

Yes. The CCPA applies based on where the affected consumer resides, not where the company is headquartered. If you are a California resident and your data was exposed, the CCPA protects you regardless of where the breaching company operates.

What if the breach happened before the CCPA took effect?

The CCPA took effect January 1, 2020. Breaches that occurred before that date are not covered by the CCPA's private right of action, though other state laws and common law claims may still apply.

Can I pursue a CCPA claim even if I join a federal class action?

This depends on the structure of the litigation. Your attorney will evaluate the available claims and determine whether CCPA state law claims should be pursued in state court, alongside federal claims, or as part of a consolidated action. The goal is always to maximize your recovery.

Your Rights Under CCPA: What California Residents Need to Know