The average CCPA settlement is $1.91 million, based on PrivacyTerms.io's calculation across all 13 confirmed CCPA settlements that the California Attorney General and California Privacy Protection Agency have publicly disclosed since August 2022. That average is misleading on its own: the median settlement is only $1.1 million, and a single record fine against General Motors accounts for more than half of every dollar collected.
What is the average CCPA settlement?
$1.91 million is the mean settlement across the 13 confirmed CCPA cases disclosed between Sephora's first case in August 2022 and General Motors' record settlement in May 2026. That figure comes from dividing the combined total, roughly $24.86 million, by the 13 individually disclosed settlement amounts. It is a useful number for estimating total regulatory exposure across the CCPA program, but a poor stand-in for what a typical company actually pays when it settles.
That gap between the mean and what most companies actually pay is the whole story behind this figure, and it comes down to one case.
Why is the median CCPA settlement so much lower than the average?
The median confirmed CCPA settlement is $1.1 million, the amount PlayOn Sports paid in March 2026 over opt-out and data-sale violations, which sits squarely in the middle of the 13 disclosed cases. That is 42% lower than the $1.91 million mean, and the reason is a single outlier: General Motors' $12.75 million settlement in May 2026 is more than 11 times the size of the next-largest case, which pulls the average far above where most settlements actually land.
Figure 1: The 8 largest of the 13 confirmed CCPA settlements. General Motors' case is more than 4 times the size of the next-largest settlement. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
Excluding General Motors entirely, the remaining 12 settlements average just $1.01 million, close to the median and a far more realistic estimate of what a typical CCPA case costs a company that settles.
How has the average CCPA settlement changed year to year?
The average settlement size has climbed sharply since 2022, but not smoothly. A single Sephora case set 2022's average at $1.2 million, no settlements were disclosed in 2023 while the CPPA stood up its enforcement authority, and the average dipped to $437,500 across two smaller 2024 cases before climbing again. The four settlements disclosed so far in 2026 average $4.24 million each, nearly five times the $876,000 average across the nine settlements from 2022 through 2025 combined.
Figure 2: Average CCPA settlement amount by year, excluding 2023 when no monetary settlements were disclosed. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
Regulators are not just bringing more cases. They are bringing bigger ones, and 2026's settlements have already reset the average twice.
Businesses that must comply with CCPA face this rising exposure directly; see our breakdown of how many businesses must comply with the CCPA for the revenue and data-volume thresholds that put a company in scope.
How much of all CCPA settlement money comes from a single case?
General Motors' $12.75 million settlement, reached over selling driver location and behavior data without adequate consent, accounts for 51% of the roughly $24.86 million collected across every confirmed CCPA settlement since 2022. No other single case comes close: the next largest, Disney's $2.75 million settlement in February 2026, is only 11% of the total.
Figure 3: General Motors' single settlement equals roughly half of every CCPA settlement dollar collected since 2022. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
A single company's case reshaping the entire average is exactly why citing the mean without the median is misleading, and it is a pattern worth watching state by state; see our tracker of US state privacy laws for how enforcement authority varies outside California.
If your site collects California residents' personal information, an outdated opt-out disclosure remains the fastest way onto this list. A privacy policy generator built for CCPA and CPRA keeps that language current without waiting for a regulator to flag the gap.
Mean or median: which CCPA settlement number should you cite?
Which average to cite depends on what you are trying to describe. The median, $1.1 million, best represents a typical case. The mean, $1.91 million, best represents total regulatory exposure across the CCPA program. The single largest case, $12.75 million, best represents worst-case exposure for a company handling large volumes of sensitive data.
Figure 4: Which CCPA settlement statistic to cite depends on what claim you are making. Source: PrivacyTerms.io analysis of California Attorney General and California Privacy Protection Agency settlement data.
Most coverage of CCPA enforcement leads with the mean because it is the bigger, more dramatic number. The median is the more honest answer to "what happens if my company gets caught."
How does each CCPA settlement compare to the average?
| Company | Settlement | vs. average | Date |
|---|---|---|---|
| General Motors / OnStar | $12,750,000 | +$10.84M | May 2026 |
| Walt Disney / ABC | $2,750,000 | +$0.84M | Feb 2026 |
| Healthline Media | $1,550,000 | -$0.36M | Jul 2025 |
| Jam City | $1,400,000 | -$0.51M | Nov 2025 |
| Tractor Supply | $1,350,000 | -$0.56M | Sep 2025 |
| Sephora | $1,200,000 | -$0.71M | Aug 2022 |
| PlayOn Sports (median) | $1,100,000 | -$0.81M | Mar 2026 |
| American Honda Motor Co. | $632,500 | -$1.28M | Mar 2025 |
| Sling TV | $530,000 | -$1.38M | Oct 2025 |
| Tilting Point Media | $500,000 | -$1.41M | Jun 2024 |
| Ford Motor Company | $375,703 | -$1.54M | Mar 2026 |
| DoorDash | $375,000 | -$1.54M | Feb 2024 |
| Todd Snyder | $345,178 | -$1.57M | 2025 |
| Average (13 cases) | $1,912,183 | -- | -- |
Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io. See our companion CCPA enforcement statistics post for the full case-by-case writeup this table is drawn from.
Eleven of the thirteen confirmed settlements land below the $1.91 million average, which is the clearest sign that citing the mean alone overstates what a typical CCPA case actually costs.
The Bottom Line
$1.91 million is the correct average CCPA settlement figure if you are measuring total regulatory exposure, but it is a poor description of what most companies actually pay. The median case, $1.1 million, and the $1.01 million average once General Motors' outlier case is excluded, both sit far closer to what 11 of the 13 confirmed settlements actually cost. The practical takeaway is the same either way: opt-out handling and data minimization gaps remain the two violations that turn into a settlement, and both are fixable before a regulator finds them rather than after.
Frequently Asked Questions
What is the average CCPA settlement amount? $1.91 million, calculated by PrivacyTerms.io from all 13 confirmed CCPA settlements publicly disclosed by the California Attorney General and California Privacy Protection Agency between August 2022 and May 2026, which total roughly $24.86 million.
Is the median CCPA settlement different from the average? Yes. The median confirmed CCPA settlement is $1.1 million, the amount PlayOn Sports paid in March 2026, which is 42% lower than the $1.91 million mean because General Motors' single $12.75 million settlement pulls the average up.
How much of total CCPA settlement money comes from one case? General Motors' $12.75 million settlement, announced May 8, 2026, accounts for 51% of the roughly $24.86 million collected across all 13 confirmed CCPA settlements since 2022.
What is the average CCPA settlement excluding the largest case? $1.01 million across the remaining 12 confirmed settlements once General Motors' $12.75 million case is set aside, based on PrivacyTerms.io's recalculation of the same public settlement data.
Where the Numbers Come From
- Hunton Andrews Kurth. (2026). "California AG Announces Record $12.75M Settlement with GM." May 8, 2026 settlement summary, the largest confirmed CCPA case and the basis of this post's mean-versus-median comparison.
- California Attorney General. (2026). "Attorney General Bonta Announces $2.75 Million Settlement with Disney." Press release, February 11, 2026, the second-largest confirmed settlement.
- Termly. (2026). "How Much Has the CCPA Cost Companies? Breaking Down $23.2 Million in Privacy Fines." Independently compiled total across 10 of the 13 cases used in this post's average, as of May 2026.
- California Attorney General. "California Consumer Privacy Act Enforcement." General enforcement case guidance and authority.
Note: All figures verified as of September 2026. The $1.91 million mean and $1.1 million median in this post are PrivacyTerms.io's own calculations, run on the same 13 confirmed settlements first compiled and individually sourced in our companion CCPA enforcement statistics post, cross-checked against Termly's independently compiled $23.2 million total across 10 disclosed cases as of May 2026. Settlement data is refreshed at least twice a year as the California Attorney General and California Privacy Protection Agency disclose new cases.
