California regulators have collected roughly $24.9 million across 13 confirmed CCPA settlements since Sephora's first case in August 2022, based on PrivacyTerms.io's compilation of every individually disclosed penalty through May 2026. The pace has accelerated sharply: 2026 alone has already produced $16.98 million in settlements, more than 2022 through 2025 combined, capped by a record $12.75 million penalty against General Motors.

California has collected 24.9 million dollars in CCPA fines since 2022 $24.9M in CCPA fines across 13settlements since 2022

How much has California collected in CCPA fines?

Thirteen confirmed monetary settlements between the California Attorney General's office and the California Privacy Protection Agency have produced roughly $24.9 million since CCPA enforcement began, per PrivacyTerms.io's tally of every individually disclosed case from Sephora's August 2022 settlement through General Motors' May 2026 settlement. A separate compilation published by Termly puts the cumulative figure at $23.2 million as of May 2026, a smaller number because its snapshot did not include every case counted here. Treat $23.2 to $24.9 million as the defensible range depending on cutoff date and which secondary actions are counted.

Figure 1: Confirmed CCPA settlement totals by year. 2023 shows zero disclosed monetary settlements because the CPPA did not gain independent enforcement authority until July 2023. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io, through May 2026.

Enforcement did not ramp up gradually. It jumped once the CPPA's own Enforcement Division became active alongside the Attorney General's existing authority, and 2026's four settlements already outweigh the combined value of every prior year.

What is the largest CCPA fine issued so far?

The largest confirmed CCPA penalty is $12.75 million, paid by General Motors and its OnStar connected-vehicle service in a settlement announced May 8, 2026 by Attorney General Rob Bonta alongside the California Privacy Protection Agency. Investigators found GM collected and sold drivers' geolocation and driving-behavior data to data brokers and insurers without adequate consent, generating an estimated $20 million in unconsented data sales between 2020 and 2024. It is the first CCPA settlement built specifically around the law's data minimization and purpose limitation requirements, not just opt-out mechanics.

Figure 2: Top 5 confirmed CCPA fines by amount. Source: California Attorney General and California Privacy Protection Agency press releases, 2025 to 2026.

Before the GM settlement, the record belonged to Disney and ABC's $2.75 million penalty in February 2026 over gaps in opt-out handling across streaming services, which itself had only recently overtaken Tractor Supply's $1.35 million CPPA settlement from September 2025. The ceiling on CCPA fines keeps resetting roughly every quarter. If your site collects California residents' personal information, you can generate a CCPA-ready privacy policy that keeps opt-out disclosures and data-sale language current with the settlements below.

How many CCPA enforcement actions has California brought?

At least 13 confirmed monetary settlements have been disclosed since August 2022, but that undercounts total enforcement activity, since most CPPA investigations never become public. Deputy Director of Enforcement Michael Macko told the CPPA's board in a September 26, 2025 meeting that the agency had hundreds of open investigations running at any given time, most undisclosed to the companies involved, and that the agency had logged 8,265 consumer complaints between July 2023 and September 2025, roughly 150 per week.

Figure 3: Milestones in CCPA and CPRA enforcement authority and activity. Source: California Privacy Protection Agency board announcements, CPPA 2025 Annual Report.

The gap between 13 disclosed settlements and hundreds of open investigations means most enforcement pressure right now is investigative, not yet monetary. A joint sweep with Colorado and Connecticut regulators in September 2025 identified every target purely through automated technical monitoring of whether sites honored the Global Privacy Control signal, not through consumer complaints, which shows how much enforcement now happens without a human complaint triggering it at all.

What CCPA violations get fined most often?

Failing to honor consumer opt-out requests, including ignoring the Global Privacy Control browser signal, is the theme behind a majority of the California Attorney General's seven disclosed CCPA settlements as of February 2026, according to the Attorney General's own announcement of the Disney case. Sephora's original 2022 case, DoorDash's 2024 case, and the 2025 to 2026 wave against Tractor Supply, Sling TV, and Disney all centered on the same underlying failure: a broken, missing, or bundled opt-out mechanism that did not actually stop the sale or sharing of personal information once a consumer or their browser requested it.

Figure 4: The per-violation cap structure behind CCPA civil penalties. Source: CCPA Section 1798.155, as applied in California Attorney General settlement announcements.

Figure 5: Approximate share of the $24.9 million total by primary violation category, based on PrivacyTerms.io's classification of each settlement's stated cause. Source: California Attorney General and California Privacy Protection Agency press releases, 2022 to 2026.

Children's data violations remain rare in dollar terms so far, limited mainly to Tilting Point's $500,000 2024 settlement over a gaming app, but regulators have signaled more attention to that category alongside the newer data-minimization theory GM's case introduced. California remains the only state with this level of confirmed monetary enforcement; see our full tracker of US state privacy laws for how the other 19 states in effect compare on enforcement authority.

How does each confirmed CCPA settlement compare?

CompanyFine amountDatePrimary violation
General Motors / OnStar$12,750,000May 2026Data minimization, unconsented data sale
Walt Disney / ABC$2,750,000February 2026Opt-out and Global Privacy Control gaps
Healthline Media$1,550,000July 2025Opt-out failures, health data sale
Jam City$1,400,000November 2025Failure to offer opt-out of sale/sharing
Tractor Supply$1,350,000September 2025Opt-out and data-sale disclosure gaps
Sephora$1,200,000August 2022First CCPA case; opt-out and GPC failure
PlayOn Sports$1,100,000March 2026Opt-out and data-sale violations
Sling TV$530,000October 2025Bundled cookie consent, opt-out gaps
American Honda Motor Co.$632,500March 2025Opt-out and disclosure violations
Tilting Point Media$500,000June 2024Children's data without parental consent
Ford Motor Company$375,703March 2026Opt-out and data-sale disclosure gaps
DoorDash$375,000February 2024Data sale without notice or opt-out
Todd Snyder$345,1782025Broken opt-out mechanism

Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io. Total: roughly $24.9 million, the hook figure for this post.

The Bottom Line

Thirteen confirmed CCPA settlements totaling roughly $24.9 million since 2022 is a small dollar figure next to GDPR's billion-euro penalties, but the trend line matters more than the total: 2026 alone has already produced more settlement dollars than the prior three years combined, and the CPPA's hundreds of open, mostly undisclosed investigations suggest the public settlement count is a lagging indicator, not the full picture. A clear majority of every settlement disclosed so far traces back to the same root cause, an opt-out mechanism that did not actually work when tested, whether that was a missing Global Privacy Control response, a bundled cookie banner, or a broken web form. That is a fixable, largely mechanical compliance gap rather than a judgment call, which makes it one of the more preventable categories of regulatory exposure a site owner faces today.

Frequently Asked Questions

How much has California collected in CCPA fines? Roughly 24.9 million dollars across 13 confirmed settlements between the California Attorney General and the California Privacy Protection Agency since Sephora's first CCPA settlement in August 2022, based on PrivacyTerms.io's count of individually disclosed cases through May 2026. A separate compilation by Termly puts the running total at 23.2 million dollars as of May 2026, a smaller figure because its snapshot did not include every case counted here.

What is the largest CCPA fine issued so far? The largest confirmed CCPA penalty is 12.75 million dollars, paid by General Motors and its OnStar connected-car service in a settlement announced May 8, 2026, over selling driver location and behavior data without adequate consent.

How many CCPA enforcement actions has California brought? At least 13 confirmed monetary settlements since August 2022, plus hundreds of open, mostly undisclosed investigations, according to CPPA Deputy Director of Enforcement Michael Macko's September 2025 board meeting update.

What is the most common CCPA violation that gets fined? Failing to honor consumer opt-out requests, including ignoring the Global Privacy Control browser signal, is the theme behind a majority of the California Attorney General's seven CCPA settlements disclosed as of February 2026.

Where the Numbers Come From

  1. California Attorney General. (2026). "Attorney General Bonta Announces $2.75 Million Settlement with Disney." Press release, February 11, 2026.
  2. Hunton Andrews Kurth. (2026). "California AG Announces Record $12.75M Settlement with GM." May 8, 2026 settlement summary.
  3. California Privacy Protection Agency. (2025). "Nation's Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations." Tractor Supply settlement, September 30, 2025.
  4. California Attorney General. (2025). "Attorney General Bonta Secures $1.4 Million Settlement with Mobile App Gaming Company." Jam City settlement, November 2025.
  5. California Attorney General. (2025). "Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com." July 2025.
  6. Termly. (2026). "How Much Has the CCPA Cost Companies? Breaking Down $23.2 Million in Privacy Fines." Compiled fine total and settlement list, as of May 2026.
  7. California Privacy Protection Agency. (2025). "2025 Annual Report." Complaint volume and enforcement authority timeline.
  8. Herbert Smith Freehills Kramer. (2026). "Favoring Compliance Over Fines: What the Latest CCPA Settlement Tells Us." Analysis of Disney settlement noting it as the 7th Attorney General CCPA settlement, March 2026.
  9. Lathrop GPM. (2026). "CCPA 2026: Navigating the Expanded Consumer Privacy Compliance Requirements." 2026 revenue threshold of $26,625,000.

Note: All figures verified as of July 2026. The $24.9 million cumulative total is PrivacyTerms.io's own compilation of 13 individually disclosed settlements and may differ slightly from other trackers depending on cutoff date; Termly's independently compiled total of $23.2 million as of May 2026 is the most-cited alternative figure. Settlement and complaint data are refreshed at least twice a year as the California Attorney General and California Privacy Protection Agency disclose new cases.