CPRA Fine Exposure Estimator
Fines are counted per violation, and violations are generally counted per affected consumer, so the total can grow quickly.
CPRA penalties run about $2,663 per negligent violation and $7,988 per intentional violation (or any violation involving a known minor under 16), adjusted for inflation every odd-numbered January.
Enter your estimated violation count and type to see a rough exposure range.
CPRA Fine Exposure Estimator
Estimated Fine Exposure
How this is calculated
Exposure = violation count × the applicable per-violation fine ($2,663 negligent, $7,988 intentional). Because violations are generally counted per affected consumer, not per practice or per incident, even a single non-compliant data practice can generate a very large total if it touched many consumers.
A violation involving personal information the business knew belonged to someone under 16 is fined at the higher, intentional rate whatever the intent. Enforcement actions by the Attorney General or the CPPA no longer come with an automatic 30-day cure period (CPRA removed it in 2023), so a business can be fined without first getting a chance to fix the violation.
This tool multiplies the per-violation amount by the number of violations. The outcome of an enforcement action depends on the facts, on settlement negotiations and on the agency's discretion.
Frequently Asked Questions
How much is a CPRA fine per violation?
As of 2026, about $2,663 per negligent violation and $7,988 per intentional violation, adjusted for inflation every odd-numbered January by the California Privacy Protection Agency (CPPA).
Is a violation involving a child's data always treated as intentional?
Yes. A violation involving the personal information of a consumer the business knew was under 16 is fined at the higher, intentional-violation amount whatever the intent.
Are fines calculated per business or per affected consumer?
Per violation, and violations are generally counted per affected consumer. One practice that violates the law for thousands of consumers can therefore add up to a very large total.
Is there still a 30-day cure period before a fine can be issued?
No. The CPRA eliminated the automatic 30-day cure period for Attorney General and CPPA enforcement actions, effective January 1, 2023. There's no guaranteed grace period to fix a violation before facing a fine.
Who enforces CPRA fines?
Both the California Attorney General and the California Privacy Protection Agency (CPPA) can bring enforcement actions and pursue civil penalties.
This tool provides an educational estimate only and is not legal advice. Enforcement amounts depend on the facts of the case and on agency discretion. Consult a privacy attorney about your exposure.