RoutineMetric

CCPA/CPRA Breach Liability Estimator

Calculate class-action statutory damages, CPPA civil penalties, and model your security-based legal defense.

This calculator assists legal counsel, CISOs, and compliance managers in modeling potential financial exposure stemming from California data security incidents. Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, failing to maintain reasonable security controls grants consumers a private right of action for statutory damages, while regulators can levy massive administrative fines.

1. Incident Scale & Scope

2. Compromised Data Categories

Only specific types of personal information qualify for the private right of action (§ 1798.150). Check all that apply:

Government IDs§ 1798.81.5(d)(1)(A)(i)

Social Security Number, passport number, military ID, or tax identification number.

Driver's License / State ID§ 1798.81.5(d)(1)(A)(ii)

California driver's license number or state-issued identification card.

Financial Account & Credentials§ 1798.81.5(d)(1)(A)(iii)

Credit card, debit card, or account number coupled with security codes, PINs, or passwords.

Medical & Health Insurance Information§ 1798.81.5(d)(1)(A)(iv)-(v)

Medical history, treatment records, diagnosis, or health insurance policy numbers.

Biometric Data§ 1798.81.5(d)(1)(A)(vi)

Unique biological characteristics such as fingerprints, facial recognition maps, or retina scans.

Email Address & Credentials§ 1798.81.5(d)(1)(A)(vii)

Email address in combination with a password, PIN, or security questions/answers.

Genetic Data§ 1798.81.5(d)(1)(A)(viii)

Detailed genomic sequencing or individual genetic testing profiles.

3. Incident Status & Mitigations

California plaintiffs must submit a 30-day pre-suit notice prior to filing for statutory damages.

4. Mitigating & Aggravating Factors

Assessment Conclusion

Critical Risk Profile
Projected Mid-Point Total Liability
$6,625,000
Range: $1.63M – $15.00M
Class Action Exposure: Unencrypted, unredacted eligible data was compromised. Statutory damages of $100 to $750 per resident apply automatically.

A. Private Class Damage Model

CCPA § 1798.150
Statutory Rate per Consumer:$100 – $750
Damage Claims Triggered:Eligible
Minimum Class Recovery ($100/ea):$500,000
Likely Midpoint Scenario ($425/ea):$2,125,000
Maximum Class Liability ($750/ea):$3,750,000

B. CPPA/AG Civil Penalties

CCPA § 1798.155
Base statutory ceiling:$2,500 / violation
Adjusted Fine per Violation:$2,250
Regulator Discretion (Min - 10%):$1,125,000
Model Standard Fine (40% level):$4,500,000
Statutory Aggregated Ceiling (100%):$11,250,000

Reasonable Security Program Defense Audit

Defense Score:45/100

Implementing these controls constitutes your primary statutory defense against the private right of action.

Enforced MFA across all corporate, email, and administrative systems.

A formalized, board-approved written security policy tailored to company risk profiles.

Sensitive databases and user records are encrypted at rest with robust key rotations.

Regular automated scanning and annual professional third-party penetration testing.

Mandatory security training and regular anti-phishing simulations for all staff.

Documented breach response workflows and regular tabletop drills with executive teams.

Rigorous security questionnaires and contractual audits for downstream suppliers.

Custom Legal Remediation Action Plan

Based on your compliance posture and selected active safeguards:

Deficient Defense Posture: Under 75 points. A court may find you failed to maintain reasonable security, creating direct liability. Priority: implement missing controls like Automated Data Encryption at Rest, Continuous Vulnerability Assessment & Pen Testing.
Critical Gap: Lack of automated encryption at rest leaves your database records completely vulnerable to statutory class actions if breached. Enforce hardware and database level encryption now.
Under California Civ. Code § 1798.81.5, courts measure "reasonableness" against the size and nature of your business and the sensitivity of personal information collected.
Advertisement
Bottom Banner Ad (728x90)

Deep Dive: Modeling Data Breach Liability Under CCPA & CPRA

Data breaches are no longer just IT incidents; they are existential legal and financial events. For entities handling personal data belonging to California residents, the California Consumer Privacy Act (CCPA), as extensively amended by the California Privacy Rights Act (CPRA), sets down some of the most stringent and punitive data security requirements in the United States.

1. Understanding the Private Right of Action (Civil Code § 1798.150)

Under most privacy statutes in the United States, enforcement is the exclusive domain of the state Attorney General, leaving consumers without the ability to sue. The CCPA breaks this mold by granting consumers a private right of action under California Civil Code Section 1798.150(a)(1).

If a business fails to maintain "reasonable security procedures and practices" appropriate to the nature of the information, and that failure results in unauthorized access, exfiltration, theft, or disclosure of non-encrypted, non-redacted personal information, California residents can sue for:

  • Statutory Damages: Between $100 and $750 per consumer, per incident.
  • Actual Damages: If actual financial harm exceeds the statutory limits.
  • Injunctive or Declaratory Relief: Mandated security audits or court-ordered operational adjustments.

This statutory damages framework is what drives massive class-action settlements. In a breach affecting 10,000 consumers, statutory damages can range from $1,000,000 to $7,500,000 without requiring plaintiffs to prove they suffered identity theft or financial loss.

2. The Statutory Gatekeepers: Encryption & Redaction

Importantly, the private right of action only triggers if the compromised data is **not encrypted** and **not redacted**. If a company successfully encrypts its databases, and the key itself is not compromised, it qualifies for a statutory safe harbor against class-action statutory damage claims. This represents an absolute technical defense that must be pursued immediately.

3. What Constitutes "Reasonable Security"?

Neither the CCPA nor the CPRA explicitly lists the precise technical controls that constitute "reasonable security". Instead, California courts and regulatory authorities assess compliance dynamically based on standard frameworks.

Historically, the California Attorney General's office released a milestone report designating the CIS Critical Security Controls (specifically the CIS Top 20) as the minimum baseline for reasonable security. Most compliance counsels advise aligning security programs with the following:

  • CIS Controls (Center for Internet Security): Implementing foundational controls such as automated inventorying, access control, and vulnerability management.
  • NIST SP 800-171 / NIST CSF: Adopting formal framework audits to prove proactive institutional oversight.
  • SOC 2 Type II / ISO 27001 Certification: Third-party verification of active organizational security operations.

4. The "Notice and Cure" Clause and Its Strict Limitations

Section 1798.150 requires plaintiffs to provide the business with a 30-day written notice identifying the specific violations of the security provisions before filing a lawsuit for statutory damages. If the company cures the violation within 30 days and gives the consumer an express written statement that the violation has been cured and no further violations will occur, the consumer is barred from pursuing statutory damages.

However, the CPRA clarified that **providing credit monitoring alone does NOT cure a data breach**. Once sensitive, unencrypted files are exfiltrated and posted on a dark web forum, they cannot be un-disclosed. Therefore, in practice, curing a breach is almost impossible unless the files were never actually stolen or if the company can definitively prove that no exfiltration or access occurred.

5. CPPA Regulatory Enforcement Penalties (§ 1798.155)

Separate from private lawsuits, the newly formed **California Privacy Protection Agency (CPPA)** and the CA Attorney General can bring administrative enforcement actions. Under § 1798.155:

  • Negligent violations: Up to $2,500 per violation.
  • Intentional violations: Up to $7,500 per violation.
  • Violations involving minors (under 16): Up to $7,500 per violation.

"Violations" are generally counted per affected consumer, meaning the maximum potential administrative fine is calculated by multiplying the number of affected Californians by $2,500 or $7,500. Regulators evaluate cooperation, historical records, business size, and the implementation of proactive controls when determining the final penalty.

Practical Steps for Privacy & Compliance Officers

  1. Inventory and Minimize Sensitive Data: Regularly map and purge databases containing Social Security numbers, financial account credentials, driver's licenses, and biometrics.
  2. Implement Pervasive Encryption: Enforce full-disk encryption and automated database-level column encryption. Ensure encryption keys are stored securely offsite.
  3. Draft and Maintain a WISP: Ensure you have a comprehensive, regularly reviewed Written Information Security Program.
  4. Enforce Multi-Factor Authentication: Eliminate static single-password accounts to stop credential-stuffing and phishing attacks.
  5. Review Downstream Vendor Agreements: Ensure downstream processors agree to robust security and indemnify you in case of a breach.

Disclaimer: This tool is for informational and educational purposes only. It is not legal advice and does not establish an attorney-client relationship. Data privacy and cyber liability involve complex statutory interpretations and highly variable case law. Always consult with qualified California privacy counsel and cybersecurity forensic experts to formulate your defense plan.

Frequently Asked Questions

Advertisement