General Motors holds the record for the largest confirmed CCPA settlement at $12.75 million, in a case the California Attorney General and California Privacy Protection Agency announced May 8, 2026, more than four and a half times the size of the next case on the list. Ranking all 13 confirmed CCPA settlements by size, instead of by date, shows a top-heavy list where two cases outweigh most of the rest combined.
What is the biggest CCPA settlement ever recorded?
General Motors and its OnStar connected-vehicle service hold the record at $12.75 million. Investigators found GM sold driver geolocation and driving-behavior data to third parties without adequate notice or consent, generating an estimated $20 million in unconsented data sales between 2020 and 2024, according to Hunton Andrews Kurth's summary of the settlement. It is the first CCPA case built specifically around the law's data minimization and purpose limitation requirements rather than opt-out mechanics alone.
Figure 1: The 8 largest of the 13 confirmed CCPA settlements, ranked by dollar amount. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
GM's case sits alone at the top, more than four and a half times the size of Disney's $2.75 million settlement in second place. From there, the ranking compresses quickly: five settlements cluster between $1.1 million and $1.55 million, and the bottom of the full 13-case list drops all the way to Todd Snyder's $345,178 case.
How much bigger is the top settlement than the rest?
The gap between rank one and rank two is unusually wide for a six-year enforcement record. General Motors' $12.75 million settlement is larger than the next seven settlements on the ranked list combined, a group worth $9.98 million together. That single case reshapes the entire ranking on its own.
That concentration is also why an average tells a different story than a ranked list does. The mean settlement across all 13 cases is $1.91 million, but our companion breakdown of the average CCPA settlement shows that only two of the 13 cases actually reach that size or higher; citing the mean alone overstates what a typical case on this list costs.
If your business collects data from California residents, closing the gap between a stale privacy policy and a working opt-out mechanism is the most direct way to stay off a list like this one. A privacy policy generator built for CCPA and CPRA keeps the required "Do Not Sell or Share" disclosure current.
How has the CCPA settlement record changed hands since 2022?
The $12.75 million record is recent. General Motors set it just months ago, and the record itself has moved three times since CCPA enforcement produced its first monetary settlement. Sephora's $1.2 million case set the original bar in August 2022 and held the title for nearly three years before Healthline Media's $1.55 million settlement overtook it in July 2025. Disney's $2.75 million case broke that record seven months later, in February 2026, and General Motors broke Disney's record three months after that, in May 2026.
Figure 2: Every settlement that has held the record for largest confirmed CCPA case since 2022. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
Three record changes inside eight months, following almost three years where the record did not move at all, is the clearest sign that CCPA settlement sizes are still finding a ceiling. California remains the only state with this level of confirmed monetary settlement history; for how enforcement authority compares elsewhere, see our tracker of US state privacy laws.
How fast has the record grown?
Plotting only the four record-setting settlements against each other shows growth that outpaces the rest of the ranked list. The record has grown more than 10-fold since 2022, and more than 4.6-fold in the four months between Disney's case and General Motors' case alone.
Figure 3: How the record for largest confirmed CCPA settlement has grown each time it changed hands. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
A ranked list built only from record holders would suggest CCPA fines are climbing toward GDPR-scale territory. A ranked list built from all 13 cases tells a calmer story: most settlements still land well under $1.5 million, and the record-setting cases remain the exception rather than the pattern.
How do the 13 settlements break down by size tier?
Grouping the 13 confirmed settlements into three size tiers shows how top-heavy the full ranking really is. Two settlements, GM and Disney, sit in the $2 million-plus tier and account for 62% of every dollar collected since 2022. Five settlements land in the $1 million to $2 million tier, worth a combined 27% of the total. The remaining six settlements, from American Honda's $632,500 case down to Todd Snyder's $345,178 case, sit under $1 million and account for just 11%.
Figure 4: Share of the roughly $24.9 million total by settlement size tier. Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
That 62% concentration in just two cases is the same reason the mean settlement sits so far above the median; the tier breakdown here and the mean-versus-median analysis in our average CCPA settlement post are two views of the same underlying dataset.
Every confirmed CCPA settlement, ranked by size
| Rank | Company | Amount | Date |
|---|---|---|---|
| 1 | General Motors / OnStar | $12,750,000 | May 2026 |
| 2 | Walt Disney / ABC | $2,750,000 | Feb 2026 |
| 3 | Healthline Media | $1,550,000 | Jul 2025 |
| 4 | Jam City | $1,400,000 | Nov 2025 |
| 5 | Tractor Supply | $1,350,000 | Sep 2025 |
| 6 | Sephora | $1,200,000 | Aug 2022 |
| 7 | PlayOn Sports | $1,100,000 | Mar 2026 |
| 8 | American Honda Motor Co. | $632,500 | Mar 2025 |
| 9 | Sling TV | $530,000 | Oct 2025 |
| 10 | Tilting Point Media | $500,000 | Jun 2024 |
| 11 | Ford Motor Company | $375,703 | Mar 2026 |
| 12 | DoorDash | $375,000 | Feb 2024 |
| 13 | Todd Snyder | $345,178 | 2025 |
Source: California Attorney General and California Privacy Protection Agency press releases, compiled by PrivacyTerms.io.
The California Privacy Protection Agency has used its own administrative enforcement authority twice on this list, against Tractor Supply in September 2025 and American Honda in March 2025; every other case was brought by the California Attorney General's office. A closer breakdown of CPPA-specific case data as the agency's own caseload grows is a storyline worth tracking on its own.
What actually pushes a CCPA settlement toward the top of the list?
The size gap between rank one and rank thirteen is not random. The costliest cases share features the smaller ones do not: a large volume of affected consumers, unusually sensitive or repurposed data, or both at once. General Motors' record case combined both, with millions of vehicles' worth of precise geolocation and driving-behavior data sold for purposes never disclosed to consumers. Smaller cases on this list typically trace to one narrow gap, such as a missing Global Privacy Control response or a single un-updated webform, rather than a systemic data practice.
Figure 5: The pattern behind where a settlement lands on the ranked list. Source: PrivacyTerms.io analysis of California Attorney General and California Privacy Protection Agency settlement announcements.
Scale and data sensitivity, more than any single violation type, appear to separate a six-figure settlement from an eight-figure one.
The Bottom Line
General Motors' $12.75 million settlement tops a ranked list of 13 confirmed CCPA settlements that totals roughly $24.9 million since 2022, but the ranking itself is more useful than the total. Two cases, GM and Disney, account for 62% of every dollar collected, the record has been broken three times in the past year alone, and the gap between rank one and rank two is wider than the distance between rank two and rank eight. For most businesses, the practical read is not that CCPA fines are about to reach eight figures routinely. It is that the two largest cases both involved a scale or sensitivity of data collection that most sites never approach, while the other eleven settlements, still averaging well over $1 million, trace back to the same fixable gap: an opt-out mechanism that did not work when a regulator tested it.
Frequently Asked Questions
What is the largest CCPA settlement ever recorded? General Motors' $12.75 million settlement, announced May 8, 2026 by the California Attorney General and California Privacy Protection Agency, over selling driver geolocation and driving-behavior data without adequate consent.
How many confirmed CCPA settlements are there to rank? 13 confirmed monetary settlements since Sephora's first case in August 2022, based on PrivacyTerms.io's compilation of every individually disclosed California Attorney General and California Privacy Protection Agency case through May 2026.
Which settlement held the CCPA record before General Motors? Walt Disney and ABC's $2.75 million settlement, announced February 11, 2026, which itself had overtaken Healthline Media's $1.55 million case from July 2025 only seven months earlier.
What is the smallest confirmed CCPA settlement? Todd Snyder's $345,178 case in 2025, the lowest of the 13 confirmed settlements and roughly 37 times smaller than General Motors' record $12.75 million case.
How many CCPA settlements exceed $1 million? 7 of the 13 confirmed settlements exceed $1 million, led by General Motors at $12.75 million; the other 6 fall as low as $345,178.
Where the Numbers Come From
- Hunton Andrews Kurth. (2026). "California AG Announces Record $12.75M Settlement with GM." May 8, 2026 settlement summary, the largest confirmed CCPA case on this list.
- California Attorney General. (2026). "Attorney General Bonta Announces $2.75 Million Settlement with Disney." Press release, February 11, 2026, the second-largest confirmed settlement.
- California Attorney General. (2025). "Attorney General Bonta Announces Largest CCPA Settlement to Date, Secures $1.55 Million from Healthline.com." July 1, 2025, the settlement that first overtook Sephora's original record.
- California Attorney General. (2025). "Attorney General Bonta Secures $1.4 Million Settlement with Mobile App Gaming Company." Jam City settlement, November 2025.
- California Privacy Protection Agency. (2025). "Nation's Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations." Tractor Supply settlement, September 30, 2025, one of two cases the CPPA brought under its own administrative authority.
- Termly. (2026). "How Much Has the CCPA Cost Companies? Breaking Down $23.2 Million in Privacy Fines." Independently compiled settlement total, as of May 2026, used here as a cross-check on the ranked total.
Note: All figures verified as of September 2026. Rankings are PrivacyTerms.io's own compilation of 13 individually disclosed settlements, cross-checked against Termly's independently compiled total of $23.2 million as of May 2026, and may shift slightly with cutoff date or how future secondary actions are counted. Settlement data is refreshed at least twice a year as the California Attorney General and California Privacy Protection Agency disclose new cases.
