Ignoring a privacy law does not carry one penalty; it carries a stack of them. California's Privacy Protection Agency set the maximum fine for an intentional CCPA violation at $7,988 in its December 2024 inflation adjustment, effective through 2026, and that is just one line in a penalty table that spans GDPR, five state privacy statutes, and HIPAA. Each law sets its own cap, its own basis for calculating a fine, and its own enforcement agency, so the real number a business is exposed to depends entirely on which laws apply to it.
Below is the penalty exposure picture across the laws that matter most to any site collecting personal data in 2026: how each cap is calculated, how the numbers compare side by side, and where the largest real-world payouts have actually landed.
How much can a single CCPA violation cost in 2026?
A standard CCPA violation now carries a maximum penalty of $2,663, and an intentional violation, or one involving a consumer the business knows is under 16, carries a maximum of $7,988, according to the California Privacy Protection Agency's December 2024 announcement. Cal. Civ. Code § 1798.155 requires the CPPA to adjust both figures for inflation every odd-numbered year, so these amounts hold through 2026 and will next change in January 2027.
Figure 1: Colorado's per-violation cap is more than double California's. Source: California Privacy Protection Agency (2024); Colo. Rev. Stat. § 6-1-112; Va. Code § 59.1-584; 740 ILCS 14/20; Connecticut Data Privacy Act enforcement provisions.
Fines apply on a per-violation basis in every one of these laws, which is what turns a modest-looking cap into real exposure: a single stale opt-out link touching 10,000 California consumers can theoretically stack toward the statutory maximum for each one. Keeping consumer-facing disclosures current is the most direct way to shrink that exposure, and a privacy policy generator built for CCPA and CPRA requirements keeps the disclosures regulators check first, notice at collection, opt-out mechanics, and retention periods, aligned with the current statute automatically.
What is the maximum GDPR fine, and how does it scale with revenue?
GDPR sets two statutory ceilings under Article 83, and regulators apply whichever is higher. Lower-tier violations, covering administrative obligations like record-keeping and certification, cap at EUR 10 million or 2% of global annual turnover. Higher-tier violations, covering core principles like lawful basis, consent, and international transfers, cap at EUR 20 million or 4% of global annual turnover.
Figure 2: The flat euro cap, not the percentage, sets the ceiling for most mid-size companies. Source: Regulation (EU) 2016/679, Article 83.
That crossover point matters more than the headline "4% of revenue" figure suggests. Applying the higher-tier cap across six illustrative revenue levels shows the flat EUR 20 million ceiling holding firm until a company's global turnover passes roughly EUR 500 million, the point where 4% of turnover overtakes the flat amount.
Figure 3: PrivacyTerms.io calculation applying GDPR Article 83(5)'s EUR 20 million-or-4%-of-turnover cap to six illustrative revenue tiers. Source: Regulation (EU) 2016/679, Article 83(5).
In practical terms, this means a company with EUR 50 million in annual revenue and a company with EUR 400 million in annual revenue face the identical EUR 20 million statutory ceiling under GDPR's higher tier. The percentage-based headline number only starts to bite once a company is large enough for 4% of its own turnover to exceed that flat amount, which is why the largest confirmed GDPR fines to date have landed almost exclusively against multinational technology platforms; see our GDPR fines statistics for 2026 for the full cumulative enforcement total.
How does penalty exposure stack across the five biggest state privacy laws?
A US business handling personal data across multiple states does not face one penalty regime, it faces as many as apply to it, each with a different cap, basis, and enforcer.
| Law | Max penalty | Basis | Enforcement |
|---|---|---|---|
| Colorado Privacy Act | $20,000 per violation, no aggregate cap | Colorado Consumer Protection Act civil penalty provision, C.R.S. § 6-1-112 | Colorado Attorney General or district attorneys |
| CCPA / CPRA (California) | $7,988 per intentional violation, $2,663 standard | Cal. Civ. Code § 1798.155, CPI-adjusted every odd year | California Privacy Protection Agency, California Attorney General |
| Virginia VCDPA | $7,500 per violation | Va. Code § 59.1-584 | Virginia Attorney General, exclusive authority |
| Illinois BIPA | $5,000 per intentional violation, $1,000 negligent, now one violation per person | 740 ILCS 14/20, amended by Public Act 103-0769 (2024) | Private right of action |
| Connecticut CTDPA | $5,000 per willful violation | Connecticut Data Privacy Act enforcement provisions | Connecticut Attorney General |
Colorado's own cap deserves a note on how it changed. Some older compliance summaries still cite a $500,000 aggregate ceiling on a related series of Colorado Consumer Protection Act violations; Colorado repealed that series cap in 2019 under HB 19-1289, so a violation affecting a large number of consumers today has no upper ceiling on total exposure, only the $20,000 per-violation figure. Businesses budgeting for privacy compliance in 2026 should treat that repeal as the current rule rather than the older, lower figure some guides still quote.
Illinois stands apart from the other four laws in one important way: it is the only one on this list that gives consumers a private right of action instead of routing enforcement exclusively through a state regulator. That distinction is a large part of why Illinois biometric privacy litigation has produced some of the largest privacy payouts in US history, covered further below.
Where does HIPAA fit into privacy penalty exposure?
HIPAA is not a general privacy law, it applies only to covered entities and business associates handling protected health information, but it belongs in any penalty exposure comparison because its top tier is an order of magnitude larger than anything in the state comprehensive privacy laws above. For penalties assessed on or after January 28, 2026, HHS's Office for Civil Rights set the top "willful neglect, not corrected" tier at up to $2,190,294 per violation category per year, following the annual civil monetary penalties inflation adjustment published in the Federal Register.
Figure 4: Penalty exposure has escalated across every major privacy and health-data law since GDPR took effect. Source: European Commission; CPPA; HHS Federal Register notice 2026-01688; Illinois Public Act 103-0769.
A hospital system, insurer, or health app that also collects general consumer data does not choose between HIPAA exposure and CCPA or GDPR exposure, it carries both at once, calculated under entirely separate statutory frameworks with entirely separate enforcement agencies.
How large can real-world biometric privacy settlements get?
Illinois BIPA's private right of action has produced settlement figures that dwarf every statutory per-violation cap on this page. Facebook settled BIPA claims over its facial-recognition tagging feature for $650 million in 2021, the largest privacy class-action settlement in US history at the time. Google settled a related set of Google Photos faceprint claims for $100 million in 2022, and TikTok settled biometric claims, alongside other privacy allegations, for $92 million in 2021.
Figure 5: Facebook's settlement alone accounts for roughly three-quarters of this three-case total. Source: American Bar Association (2021); Engadget/TopClassActions (2022); Variety (2021).
Exposure from future BIPA claims changed meaningfully in August 2024, when Illinois enacted Public Act 103-0769, limiting recovery to one violation per person regardless of how many times a company collected or used that person's biometric data through the same method. A Seventh Circuit ruling in April 2026 confirmed the amendment applies retroactively to cases that were already pending, which caps future BIPA exposure well below the per-scan multiplication that produced the settlements above. Treat that retroactive ruling as a live legal development rather than a permanently settled question, since further appeals remain possible.
How many US states now carry their own separate penalty exposure?
Only 20 of the 50 US states, 40%, had a comprehensive consumer privacy law in effect as of 2026, per the IAPP's US State Privacy Legislation Tracker. Four more states had enacted a law not yet in effect, and 26 states had no comprehensive privacy law on the books at all.
Figure 6: More than half the country still has no comprehensive privacy law, but each of the 20 that do adds its own separate penalty regime. Source: IAPP US State Privacy Legislation Tracker.
A business operating nationally does not face "US privacy law" as a single line item, it faces a patchwork where every one of those 20 states can impose its own maximum penalty independently, on top of whatever federal or sector-specific exposure already applies. See our CCPA fines and penalties list for how California's enforcement record has played out under its own cap since 2022.
The Bottom Line
Penalty exposure for ignoring privacy law is not one number, it is a stack that grows with every additional law that applies to a business. A company handling California residents' data carries CCPA's $7,988 per-violation ceiling; one handling EU data carries GDPR's EUR 20 million or 4% of turnover cap; one operating across Colorado, Virginia, Illinois, and Connecticut carries four more separate caps on top of that, and Illinois's private right of action has already produced settlements in the hundreds of millions of dollars, well above every statutory cap on this page. A 2017 Ponemon Institute study, the most recent large-scale study of its kind and now nine years old, found non-compliant organizations spent an average of $14.82 million a year against $5.47 million for compliant ones, a gap that predates most of the laws in this post and likely understates today's stacked exposure. The practical response is the same regardless of which laws apply: keep the underlying disclosures, consent mechanics, and opt-out handling current, since almost every cap above is triggered by a gap in exactly those three things.
Frequently Asked Questions
What is the maximum fine for a single CCPA violation in 2026? $7,988 for an intentional violation or one involving a consumer under 16, and $2,663 for a standard violation, according to the California Privacy Protection Agency's inflation adjustment announced in December 2024 and in effect through 2026.
What is the maximum GDPR fine a company can face? EUR 20 million or 4% of a company's global annual turnover, whichever is higher, for the most serious violations under Article 83(5) of the GDPR. Lower-tier violations cap at EUR 10 million or 2% of turnover.
Which US state privacy law carries the highest per-violation penalty? Colorado's Privacy Act, enforced through the state's Consumer Protection Act civil penalty provision, at up to $20,000 per violation with no aggregate ceiling since Colorado repealed a $500,000 series cap in 2019.
How much can Illinois BIPA lawsuits cost a company? Historically, some of the largest privacy payouts on record: Facebook settled for $650 million in 2021, Google for $100 million in 2022, and TikTok for $92 million in 2021. A 2024 amendment now limits recovery to one violation per person, reducing exposure for future claims.
Where the Numbers Come From
- California Privacy Protection Agency. (2024). "California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties." $2,663 standard / $7,988 intentional violation caps, effective January 1, 2025 through 2026.
- gdpr-info.eu, reproducing Regulation (EU) 2016/679. "Article 83: General conditions for imposing administrative fines." EUR 10M/2% and EUR 20M/4% two-tier cap structure.
- Federal Register. (2026). "Annual Civil Monetary Penalties Inflation Adjustment." HHS Office for Civil Rights, HIPAA top tier $2,190,294 per violation category per year, effective for penalties assessed on or after January 28, 2026.
- Justia, Code of Virginia. Section 59.1-584, Virginia Consumer Data Protection Act civil penalty of up to $7,500 per violation, Attorney General exclusive enforcement.
- DuPage County Bar Association. "Clear as Mud: How the Amendment to the Biometric Information Privacy Act Impacts Pending Lawsuits." 740 ILCS 14/20 statutory damages and Illinois Public Act 103-0769 (2024) one-violation-per-person amendment.
- American Bar Association. (2026). "7th Circuit Holds BIPA Damages Remedy Applies Retroactively." Seventh Circuit ruling, April 2026, on Public Act 103-0769's retroactive effect.
- American Bar Association. (2021). "Historic Biometric Privacy Suit Settles for $650 Million." Facebook Illinois BIPA settlement, final approval February 2021.
- Engadget. (2022). "Google settles Photos facial recognition lawsuit for $100 million." Illinois BIPA settlement, final approval September 2022.
- Variety. (2021). "TikTok Agrees to Pay $92 Million to Settle Class-Action Lawsuit Alleging Privacy Violations." Preliminary approval October 2021.
- IAPP. "US State Privacy Legislation Tracker." 20 of 50 states with a comprehensive privacy law in effect, 4 more enacted, as of 2026.
- Globalscape and Ponemon Institute. (2017). "Data Protection Non-Compliance Expenses Up 45 Percent, Costing an Average $14 Million." Non-compliance cost $14.82 million average versus $5.47 million for compliance; the most recent large-scale study of its kind, now nine years old.
Note: All figures verified as of July 2026. The Illinois BIPA retroactivity ruling and Colorado's repealed aggregate cap are both noted above as context that has shifted from older reporting; penalty figures are refreshed at least twice a year as agencies publish new inflation adjustments.
