California regulators have brought 13 confirmed CCPA enforcement settlements since Sephora's first case in August 2022, according to PrivacyTerms.io's chronological review of every publicly announced California Attorney General and California Privacy Protection Agency action through May 2026. Enforcement has not moved at a steady pace: four of those 13 cases were announced in the first five months of 2026 alone. Below is every confirmed action, in order, with the amount and the violation behind it.
How many CCPA enforcement actions have been confirmed?
13 settlements have been publicly confirmed between August 2022 and May 2026, combining civil actions brought by the California Attorney General's office and administrative fines issued directly by the California Privacy Protection Agency, which gained its own independent enforcement authority in July 2023. That count only includes cases with a disclosed outcome; CPPA Deputy Director of Enforcement Michael Macko told the agency's board in a September 2025 meeting that the agency runs hundreds of open investigations at any given time, most of which never become public unless they end in a settlement.
Figure 1: Milestones in CCPA and CPRA enforcement authority and activity. Source: California Privacy Protection Agency board announcements and California Attorney General press releases, 2020 to 2026.
The pace of confirmed cases has climbed every year enforcement has been active, with a sharp jump once the CPPA's own enforcement division joined the Attorney General's existing authority.
Every confirmed CCPA fine and settlement, in order
The table below lists all 13 confirmed CCPA settlements chronologically, from Sephora's first case through General Motors' record-setting May 2026 penalty. Two of the 13 (Tractor Supply and Honda) were administrative fines brought directly by the CPPA rather than civil settlements with the Attorney General's office.
| Date | Company | Amount | Primary violation |
|---|---|---|---|
| August 2022 | Sephora | $1,200,000 | Failed to process opt-out requests via Global Privacy Control |
| February 2024 | DoorDash | $375,000 | Sold customer data through a marketing cooperative without disclosure |
| June 2024 | Tilting Point Media | $500,000 | Collected children's data without verified parental consent |
| 2025 | Todd Snyder | $345,178 | Broken opt-out mechanism for sale of personal information |
| March 2025 | American Honda Motor Co. (CPPA) | $632,500 | Excess data collection thresholds and unverified vendor contracts |
| July 2025 | Healthline Media | $1,550,000 | Opt-out failures tied to sale of health-related data |
| September 2025 | Tractor Supply (CPPA) | $1,350,000 | Inadequate privacy notices, no job-applicant privacy disclosures, broken opt-out |
| October 2025 | Sling TV | $530,000 | Bundled cookie consent, opt-out gaps |
| November 2025 | Jam City | $1,400,000 | Failure to offer a working opt-out of sale/sharing |
| February 2026 | Disney / ABC | $2,750,000 | Opt-out requests not honored across every linked streaming device |
| March 2026 | PlayOn Sports | $1,100,000 | Opt-out and data-sale disclosure gaps |
| March 2026 | Ford Motor Company | $375,703 | Opt-out and data-sale disclosure gaps |
| May 2026 | General Motors / OnStar | $12,750,000 | Sold driver geolocation and driving-behavior data without adequate consent |
Source: California Attorney General and California Privacy Protection Agency public announcements, compiled by PrivacyTerms.io. Combined total: roughly $24.9 million.
Figure 2: Count of confirmed CCPA settlements by year. 2023 shows zero because the CPPA did not gain independent enforcement authority until July of that year. Source: PrivacyTerms.io compilation of California Attorney General and California Privacy Protection Agency announcements.
California residents' opt-out rights are the thread running through most of these cases. A privacy policy generator built for CCPA and CPRA disclosures keeps "Do Not Sell or Share" language and Global Privacy Control handling current with what these settlements are actually penalizing.
Which regulator brings each case, the AG or the CPPA?
Both agencies can bring a CCPA case, and they have used that authority differently. The California Attorney General's office has handled most of the 13 confirmed settlements as civil enforcement actions, including Sephora, DoorDash, Disney, and General Motors. The California Privacy Protection Agency, which only gained its own independent enforcement authority in July 2023, has so far used it twice: a $1.35 million administrative fine against Tractor Supply in September 2025, which the agency itself called the largest fine in its history, and a $632,500 fine against American Honda Motor Co. in March 2025.
Figure 3: Split of the 13 confirmed settlements by which agency brought the case. Source: California Attorney General and California Privacy Protection Agency public announcements.
The two agencies also differ in what they can penalize. The CPPA's Tractor Supply order broke new ground by citing a failure to disclose privacy rights to job applicants, not just consumers, which is a category the Attorney General's civil settlements have not addressed directly.
Figure 4: The general path a confirmed CCPA violation follows to a public settlement or fine. Source: PrivacyTerms.io summary of California Attorney General and CPPA enforcement structure.
What is the largest CCPA enforcement action so far?
General Motors and its OnStar connected-vehicle service paid $12.75 million in a settlement announced in May 2026, the largest confirmed CCPA penalty to date and nearly five times the prior record. Investigators found GM sold drivers' geolocation and driving-behavior data to insurance brokers and data brokers without adequate consent. It was also the first CCPA settlement built specifically around the law's data minimization and purpose limitation requirements rather than a broken opt-out mechanism.
Before General Motors, the record belonged to Disney and ABC's $2.75 million settlement in February 2026, itself announced as the seventh CCPA enforcement action under the Attorney General's office. That settlement had only recently overtaken Tractor Supply's $1.35 million CPPA fine from September 2025. The ceiling on confirmed CCPA penalties has reset three times in less than a year.
Figure 5: Running total of confirmed CCPA settlement dollars. Source: PrivacyTerms.io compilation of California Attorney General and California Privacy Protection Agency announcements, 2022 to 2026.
For a fuller trend view of dollar totals and violation categories, see our separate CCPA enforcement dollar breakdown, which tracks the same 13 cases from the total-dollars angle rather than the case-by-case list here.
How did the cure period disappear?
CCPA originally gave businesses a mandatory 30-day window to fix a violation before facing a fine, but that guaranteed right expired January 1, 2023 under the CPRA amendments. Attorney General Rob Bonta flagged the change directly in the Sephora announcement itself, warning that businesses' automatic right to cure a violation and avoid liability was running out. Every confirmed settlement since then has been negotiated without that guaranteed off-ramp.
| Period | Cure right | Fine exposure |
|---|---|---|
| Before January 1, 2023 | Mandatory 30-day cure window before any fine | No penalty if fixed in time |
| After January 1, 2023 | No guaranteed cure right for most violations | Fine can apply without a fix-it-first period |
Source: CCPA Section 1798.155, as amended by CPRA; California Attorney General's August 2022 Sephora settlement announcement.
Civil penalties are still capped by statute at $2,500 per unintentional violation and $7,500 per intentional violation, but with the mandatory cure period gone, more violations now reach that cap instead of getting resolved with a corrective notice.
Businesses with California customers face similar exposure under other state privacy laws; see our full tracker of US state privacy laws in 2026 for how the other 19 states in effect compare on enforcement authority, and our count of how many businesses must comply with the CCPA for who this actually applies to.
The Bottom Line
13 confirmed CCPA enforcement actions in under four years is not a slow regulatory track record, and the case-by-case list above shows the pace accelerating rather than leveling off: four settlements landed in the first five months of 2026 alone, more than 2022 through 2025 combined. A clear majority of these 13 cases trace back to the same root cause, an opt-out mechanism, cookie banner, or Global Privacy Control response that did not actually work when tested. That is a mechanical, fixable compliance gap rather than a judgment call, and with the mandatory 30-day cure period gone since January 2023, it is also one businesses no longer get an automatic chance to fix before a regulator turns it into a public settlement.
Frequently Asked Questions
How many CCPA enforcement actions have been confirmed? 13 confirmed CCPA enforcement settlements have been announced since Sephora's first case in August 2022, per public records from the California Attorney General's office and the California Privacy Protection Agency through May 2026.
What is the largest CCPA enforcement action so far? General Motors and its OnStar connected-car service paid 12.75 million dollars in a settlement announced May 2026, over selling driver geolocation and driving-behavior data without adequate consent. It is nearly five times the prior record.
Does the Attorney General or the CPPA bring CCPA cases? Both. The California Attorney General's office has brought most of the 13 confirmed settlements as civil enforcement actions, while the California Privacy Protection Agency has used its own administrative enforcement authority twice, against Tractor Supply in September 2025 and American Honda Motor Co. in March 2025.
Is there still a 30-day cure period for CCPA violations? No, not as a guaranteed right. The mandatory 30-day cure period expired January 1, 2023 for most violations under the CPRA amendments, and Attorney General Rob Bonta said as much announcing the Sephora settlement in August 2022, warning that the automatic right to fix a violation before facing a fine was expiring.
Where the Numbers Come From
- California Attorney General's Office. (2022). "Attorney General Bonta Announces Settlement with Sephora." $1.2 million settlement, the first confirmed CCPA enforcement action.
- California Privacy Protection Agency. (2025). "Tractor Supply Settlement Announcement." $1.35 million administrative fine, the largest in CPPA history at the time.
- California Attorney General's Office. "California Consumer Privacy Act (CCPA)." Enforcement authority, cure-period history, and civil penalty structure.
- California Privacy Protection Agency. Agency enforcement authority and board meeting announcements, including the September 2025 update on open investigation volume.
Note: All figures verified as of September 2026. CCPA and CPRA enforcement data is refreshed at least twice a year as the Attorney General's office and the CPPA disclose new settlements.
