The CCPA’s most expensive sentence is one businesses rarely read until a breach: statutory damages of $100 to $750 per consumer per incident, no injury required. Section 1798.150 quietly federalized nothing and changed everything in California breach litigation, replacing the old fight over standing and damages with simple multiplication. Understanding its narrow trigger, and the encryption off-switch built into it, is the difference between a manageable incident and a bet-the-quarter class action.
| Provision | Cal. Civ. Code 1798.150 |
|---|---|
| Trigger | Breach of nonencrypted, nonredacted PI due to unreasonable security |
| Damages | $100-$750 per consumer per incident, statutory |
| Covered data | 1798.81.5 categories (SSN, DL, financial, medical, biometric, credentials) |
| Statute text | Civ. Code 1798.150 |
How the claim works in practice
The narrow data definition is the first battleground. Email-plus-password breaches qualify (credentials); marketing-database breaches of names and emails alone generally do not. Plaintiffs plead broadly; early motions turn on whether the exfiltrated fields match 1798.81.5.
“Resulting from” makes security the merits. Unlike strict-liability statutes, 1798.150 requires the breach to result from failure to maintain reasonable security appropriate to the data. A documented, benchmarked program is both compliance and litigation defense; its absence, discoverable through post-incident forensics, is the plaintiff’s case.
The cure notice rarely saves defendants. Statutory-damages plaintiffs must give 30 days’ notice and an opportunity to cure. Businesses argue remediation; courts have reasoned that exposure of data cannot be undone, so the cure defense mostly helps against alleged ongoing security failures, not completed breaches. Actual-damages claims need no notice at all.
It stacks with everything else. The same incident triggers California’s breach-notification statute, AG scrutiny, CCPA administrative enforcement for related notice failures, and, for biometric data, potential BIPA-style claims if Illinois residents are involved. National incidents get a state-by-state overlay; the state enforcement tracker maps the public-enforcement side.
The engineering answer
Because the right attaches only to nonencrypted, nonredacted data, encryption is worth more than any policy: full encryption at rest for 1798.81.5 categories, tokenization of payment and SSN fields, and TLS everywhere effectively deletes the statutory-damages exposure even when attackers get in. Pair it with aggressive retention limits, data you deleted cannot be exfiltrated, and an inventory that knows where qualifying categories live. A free scan helps with the outer layer: what your public-facing systems collect and where they send it.