Under the CCPA as amended by the CPRA, who enforces the law, and how do the CPPA and the Attorney General divide the work?

## Three enforcement routes The **California Consumer Privacy Act (CCPA)**, as amended by the **California Privacy Rights Act (CPRA)**, is enforced along three separate routes. Knowing which one applies tells you who acts, where, and what money is at stake. | Route | Who | Where | Remedy | Source | |---|---|---|---|---| | Administrative | California Privacy Protection Agency (CPPA) | agency proceedings under the Administrative Procedure Act | cease-and-desist order, **administrative fine** per violation | 1798.155; 1798.199.55 | | Civil | Attorney General | superior court, in the name of the People of California | **injunction**, **civil penalty** per violation | 1798.199.90 | | Private | a consumer, individually or as a class | court | statutory or actual damages, injunctive or declaratory relief | 1798.150 | ## The CPPA: administrative enforcement The CPRA created the **CPPA** and gave it the job to *administer, implement, and enforce through administrative actions* the CCPA (Civil Code 1798.199.40(a)). It also makes the regulations (1798.199.40(b)). Its enforcement powers include: - **Investigating** on a **sworn complaint** or on **its own initiative** (1798.199.45(a)); the regulations add that it may act on referrals and on nonsworn or anonymous complaints (11 CCR 7301(a)). - **Subpoenas** for witnesses and records, including in support of its power to **audit** a business (1798.199.65; 11 CCR 7304). - A **probable-cause proceeding**, then a **hearing**, then an order that may require the business to cease and desist and to pay an **administrative fine** (1798.199.50, 1798.199.55). The agency does not need to go to court to impose the fine; it goes to court only to collect a fine that is not paid (1798.199.75). ## The Attorney General: civil enforcement Under 1798.199.90(a), any business, service provider, contractor or other person that violates the CCPA is subject to an **injunction** and a **civil penalty** per violation, *assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General*. The court may consider **good-faith cooperation** when setting the amount. ## How the two relate The statute deliberately prevents the two public enforcers from colliding: 1. **The Attorney General can take over.** On the Attorney General's request, the CPPA **shall stay** its administrative action or investigation and not pursue it unless the Attorney General later decides not to act (1798.199.90(c)). 2. **The agency cannot fence the Attorney General in.** The CPPA *may not limit the authority of the Attorney General* to enforce the title (1798.199.90(c)). 3. **No second bite.** The Attorney General cannot file a civil action for a violation after the agency has issued a decision or order against that person for the same violation (1798.199.90(d)). 4. **No double payment.** A business shall not be required to pay **both** an administrative fine and a civil penalty for the **same violation** (1798.199.100). 5. **Same price list.** Both routes use the same per-violation ceilings, CPI-adjusted by the agency (1798.155(a); 1798.199.90(a); 1798.199.95(d)). ## Where consumers fit Consumers are not general enforcers. The **private right of action** in Civil Code **1798.150** exists only for a breach of specified personal information caused by the business's failure to maintain **reasonable security**, and 1798.150(c) says it applies only to those violations and *shall not be based on violations of any other section*. A consumer who thinks a business ignored their deletion request can complain to the agency, but cannot sue under the CCPA for it. The Attorney General's civil route does not affect the private right of action (1798.199.90(e)). ## Routing one incident through the three lanes Suppose a business both ignores consumers' requests to delete and later suffers a breach of customers' email addresses with passwords that permit account access, traced to missing basic security controls. - The ignored deletion requests are violations the **CPPA** can investigate and fine, or the **Attorney General** can sue over, but not both for the same violation. - The breach can be pursued by the same public enforcers **and** opens the **private right of action** under 1798.150, where affected consumers can seek statutory damages per consumer per incident. - If the Attorney General chooses to act first on either, the agency steps back on request. The public routes price each violation; the private route prices each affected consumer, which is why a breach tends to dominate the exposure. ## Misconceptions to avoid - That the CPPA replaced the Attorney General: both enforce, with the Attorney General able to take a case over. - That the agency needs a consumer complaint before it can act. - That fines and penalties stack for one violation. - That a consumer can sue over any CCPA failure.