Fines and enforcement

How the CPPA enforces the CCPA in California

Last checked 25 October 2026 · 4 sources

Short answer

The California Privacy Protection Agency (CPPA) enforces the California Consumer Privacy Act (CCPA) through administrative actions and fines ^1,2. The agency states that the CCPA allows administrative fines of up to $2,500 for each violation and up to $7,500 for each intentional violation, applied per violation ². In 2025 the agency ordered Honda to pay $632,500, Todd Snyder $345,178 and Tractor Supply $1,350,000 ^2,3⁴. The agency moved its announcements to privacy.ca.gov in January 2026 ¹.

Enforcer: California Privacy Protection Agency (CPPA) ¹
Law: California Consumer Privacy Act (CCPA) ²
Fine per violation: Up to $2,500 ²
Fine per intentional violation: Up to $7,500 ²
Honda order, March 2025: $632,500 ²
Tractor Supply order, September 2025: $1,350,000 ⁴

Who enforces the CCPA and how

The California Privacy Protection Agency brings administrative enforcement actions under the CCPA and publishes orders and settlements ¹. Its Enforcement Division has acted against data brokers over registration under the Delete Act and against companies over the handling of consumer privacy requests ¹. The agency settled with a first set of data brokers on 14 November 2024 and ran further data broker actions through 2025 and into January 2026 ¹. In January 2026 the agency, now using the name CalPrivacy, moved its announcements to privacy.ca.gov ¹. The orders require companies to change practices and, in some cases, to certify compliance each year, as in the Tractor Supply order ^1,4.

How fines are set

The agency has stated that the CCPA allows administrative fines of up to $2,500 per violation, or $7,500 per intentional violation, with an increase for inflation ². In the Honda announcement the agency said fines apply on a per violation basis ². Each order sets its own total ^2,3⁴.

2025 orders

In 2025 the agency issued orders requiring companies to pay fines and change their privacy practices ^2,3⁴.

Date	Company	Fine
12 March 2025 ²	American Honda Motor Co. ²	$632,500 ²
6 May 2025 ³	Todd Snyder, Inc. ³	$345,178 ³
30 September 2025 ⁴	Tractor Supply Company ⁴	$1,350,000 ⁴

Common violations found

The agency's announcements of the three 2025 orders describe violations alleged by its Enforcement Division, and they point to recurring problems with how companies handle opt-out and privacy requests ^2,3⁴.

Requiring excessive verification or more personal information than needed to exercise privacy rights, cited in the Honda and Todd Snyder announcements ^2,3.
An opt-out mechanism that did not work, including opt-out requests left unprocessed for 40 days, cited in the Todd Snyder announcement ³.
No effective way to opt out, including through opt-out preference signals such as Global Privacy Control, cited in the Tractor Supply announcement ⁴.
Sharing personal information with other companies without contracts containing required privacy protections, cited in the Honda and Tractor Supply announcements ^2,4.
Failing to tell California job applicants about their privacy rights and how to use them, cited in the Tractor Supply announcement ⁴.

Common questions

Who enforces the CCPA?

The California Privacy Protection Agency, through administrative enforcement actions and orders brought by its Enforcement Division ^1,2.

How large can a CCPA fine be?

The agency has stated the CCPA allows administrative fines of up to $2,500 per violation and up to $7,500 per intentional violation ².

What was the largest CPPA fine in 2025?

The $1,350,000 order against Tractor Supply Company on 30 September 2025 ⁴.

What practices led to the 2025 fines?

The agency's announcements cite excessive verification, broken opt-out tools, ignoring opt-out preference signals, and sharing data without required contracts, across the Honda, Todd Snyder and Tractor Supply orders ^2,3⁴.

When did the CPPA start issuing orders?

Its Enforcement Division settled with a first set of data brokers on 14 November 2024 and issued company orders through 2025, including the Honda order of 12 March 2025 ^1,2.

Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.

Sources

FTC data security enforcement explained
How the US Federal Trade Commission brings data security cases, what consent orders require, when it can seek money, and its breach reporting rules.
US state breach notification laws explained
How US state data breach laws work, with deadlines, regulator notice and penalties from the statutes of California, Washington, Florida and New York.
What a regulator reprimand means
A reprimand is a formal finding of a breach without, or alongside, a fine. How the GDPR, the UK ICO, Ireland's DPC and France's CNIL use reprimands.
Data protection fines reduced or cancelled on appeal
Court rulings that cut, cancelled or upheld privacy fines in Germany, France, Luxembourg, Italy, Ireland, the UK and South Korea, with dates.