California Codes

Cal. Civil Code § 1798.150 (2026)

✓ current as of May 2026

Find cases: SyfertCases citing this section CA-LEGleginfo.legislature.ca.gov JustiaCode on Justia CornellLII Search CasesGoogle Scholar

Personal Information Security Breaches

(a)(1)Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, or whose email address in combination with a password or security question and answer that would permit access to the account is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:

(A)To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. The amounts in this subdivision shall be adjusted pursuant to subdivision (d) of Section 1798.199.95.

(B)Injunctive or declaratory relief.

(C)Any other relief the court deems proper.

(2)In assessing the amount of statutory damages, the court shall consider any one or more of the relevant circumstances presented by any of the parties to the case, including, but not limited to, the nature and seriousness of the misconduct, the number of violations, the persistence of the misconduct, the length of time over which the misconduct occurred, the willfulness of the defendant’s misconduct, and the defendant’s assets, liabilities, and net worth.

(b)Actions pursuant to this section may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated. In the event a cure is possible, if within the 30 days the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business. The implementation and maintenance of reasonable security procedures and practices pursuant to Section 1798.81.5 following a breach does not constitute a cure with respect to that breach. No notice shall be required prior to an individual consumer initiating an action solely for actual pecuniary damages suffered as a result of the alleged violations of this title. If a business continues to violate this title in breach of the express written statement provided to the consumer under this section, the consumer may initiate an action against the business to enforce the written statement and may pursue statutory damages for each breach of the express written statement, as well as any other violation of the title that postdates the written statement.

(c)The cause of action established by this section shall apply only to violations as defined in subdivision (a) and shall not be based on violations of any other section of this title. Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law. This shall not be construed to relieve any party from any duties or obligations imposed under other law or the United States or California Constitution.

Notes of Decisions

Cited in 40 cases (39 in the last 5 years), 2020–2025 · leading case: Jarman v. HCR ManorCare, Inc., 471 P.3d 1001 (Cal. 2020).

Sort: Relevance Newest Treatment

Jarman v. HCR ManorCare, Inc., 471 P.3d 1001 (Cal. 2020). “, Civ. Code, § 1798.150, subd. (a)(2).) These deficiencies, including the lack of textual guidance and specificity, suggest that the Legislature did not focus on calibrating any monetary relief to the nature of each patient right and violation articulated in section 1430(b).”

Florence v. Order Express, Inc. (N.D. Ill. 2023). · cites it 5× “Cal. Civ. Code § 1798.150 (a)(1); In re Arthur J.”

Houghton v. Rancho Mesquite Casino, Inc. (D. Nev. 2024). · cites it 4× “” Cal. Civ. Code § 1798.150 (a)(1). 8 Eureka first argues that the Houghton plaintiffs make conclusory allegations that fail to 9 state a plausible CCPA claim.”

In re Warner Music Grp. Data Breach (S.D.N.Y. 2025). · cites it 4× “]” Cal. Civ. Code § 1798.150 (a)(1); see Waste Mgmt.”

Durgan v. U-Haul Int'l Inc. (D. Ariz. 2023). · cites it 3× “” Cal. Civ. Code § 1798.150 (a). To prevail on a CCPA 7 claim, “a plaintiff must allege that his personal information was subject to 8 ‘unauthorized .”

Lindquist v. Ncb Mgmt. Servs., Inc. (E.D. Pa. 2024). · cites it 3× “California Consumer Privacy Act In Count XIII, the California plaintiffs assert a claim against NCB under the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code §§ 1798.150 , et seq. The CCPA creates a private right of action for any consumer whose PII is disclosed as a…”

Jack Gershfeld v. Teamviewer US, Inc. (C.D. Cal. 2021). · cites it 2× “¶¶ 19–20); see Cal. Civ. Code § 1798.150 . He also alleges that 9 Defendant violated the UCL by, among other things, unlawfully charging him for 10 services that he did not authorize, need, or want.”

Randles v. Mr. Cooper Grp., Inc. (E.D. Cal. 2024). · cites it 2× “Cooper’s 13 failure to maintain reasonable security procedures and practices to protect consumers’ personal 14 information, in violation of Cal. Civ. Code § 1798.150 , the California Consumer Privacy Act 15 (“CCPA”).”

Wynne v. Audi of Am. (N.D. Cal. 2022). · cites it 2× “26 Cal. Civ. Code § 1798.150 (a)(1). The statute authorizes statutory damages, actual damages, 27 injunctive or declaratory relief, and “[a]ny other relief the court deems proper” for violations.”

Etop Udo v. Wells Fargo Bank, N.A. (N.D. Cal. 2023). · cites it 2× “10 Cal. Civ. Code § 1798.150 (a)(1). “Personal information” means a consumer’s first and last name 11 in combination with, inter alia, “[a]ccount number or credit or debit card number, in combination 12 with any required security code, access code, or password that would permit…”

Fierro v. USA Waste-Mgmt. Resources, LLC (S.D.N.Y. 2022). · cites it 2× “” Cal. Civ. Code § 1798.150 (a)(1). To bring a claim for statutory damages, a consumer must provide written notice at least 30 days before filing an action.”

C.M. v. BetterHelp, Inc. (N.D. Cal. 2024). · cites it 2× “” Cal. Civ. Code § 1798.150 (emphasis added).”

Show all 40 citing cases →

— Cal. Civil Code § 1798.150(a) — 1 case

Hawkins v. Scout Energy Mgmt. LLC (N.D. Tex. 2025).

— Cal. Civil Code § 1798.150(a)(1) — 2 cases

Florence v. Order Express, Inc. (N.D. Ill. 2023). “Cal. Civ. Code § 1798.150 (a)(1); In re Arthur J.”

Matthew Kenney v. Bank of Am., N.A. (C.D. Cal. 2025).

Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.