California Privacy Rights Act (CPRA): What It Changed and When You Can Sue

They are not two competing laws. The CCPA is the 2018 statute; the CPRA is the 2020 ballot measure that rewrote large parts of it. Since the CPRA's changes took effect on January 1, 2023, there is one California consumer privacy law, codified at Cal. Civ. Code § 1798.100 and following. Regulators and courts usually refer to it as the CCPA as amended by the CPRA, which is why you will see enforcement actions announced under the CCPA name even though they apply CPRA-era requirements.

Only in one situation. Cal. Civ. Code § 1798.150 lets a California resident sue when certain nonencrypted and nonredacted personal information is exposed in a breach because a business failed to maintain reasonable security. Every other obligation in the law — honoring opt-outs, posting a notice at collection, responding to deletion requests — is enforced by regulators, not by private lawsuits. The statute says expressly that it cannot serve as the basis for a private right of action under any other law.

Cal. Civ. Code § 1798.150 provides statutory damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater. A court decides where in that range an award falls, and only if a violation is proven or a settlement is reached. In practice the figure most California class members see is a negotiated settlement amount rather than the statutory maximum, which is why some data breach settlements list a separate, usually modest, payment for California residents on top of the general cash benefit.

The CPRA created a distinct category that includes Social Security, driver's license, state ID and passport numbers; account log-in and financial account credentials; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, and union membership; the contents of mail, email and text messages where the business is not the intended recipient; genetic data; biometric information processed to uniquely identify someone; and information about health, sex life or sexual orientation. Consumers can direct a business to limit the use and disclosure of this category to what is necessary to provide the goods or services requested.

The rights belong to California residents. A company headquartered elsewhere can still be covered if it does business in California and meets one of the coverage thresholds, but a resident of another state cannot use the CPRA to demand deletion or bring a § 1798.150 breach claim. Other states have passed their own privacy statutes, and most of them, like Florida's, give consumers no right to sue at all and leave enforcement entirely to the state attorney general.

No. Civil penalties recovered by the California Privacy Protection Agency or the Attorney General are paid to the state, not distributed to the people whose data was involved. A regulator's settlement typically also imposes injunctive terms — fixing opt-out mechanisms, rewriting vendor contracts, reporting to the Attorney General for a period of years. Money reaches consumers through a class action settlement, which is a separate proceeding with its own claim process.