CPRA Fine Exposure Estimator
Fines are counted per violation, and violations are generally counted per affected consumer — exposure can scale fast.
CPRA penalties run about $2,663 per negligent violation and $7,988 per intentional violation (or any violation involving a known minor under 16), adjusted for inflation every odd-numbered January.
Enter your estimated violation count and type to see a rough exposure range.
CPRA Fine Exposure Estimator
Estimated Fine Exposure
How this is calculated
Exposure = violation count × the applicable per-violation fine ($2,663 negligent, $7,988 intentional). Because violations are generally counted per affected consumer, not per practice or per incident, even a single non-compliant data practice can generate a very large total if it touched many consumers.
A violation involving personal information the business knew belonged to someone under 16 is automatically treated at the higher, intentional rate, regardless of actual intent. There is no automatic 30-day cure period anymore for AG/CPPA enforcement actions (eliminated by CPRA in 2023), so a violation can result in a fine without a guaranteed chance to fix it first.
This tool provides a simple multiplication only — actual enforcement outcomes depend heavily on the specific facts, any settlement negotiations, and prosecutorial discretion.
Frequently Asked Questions
How much is a CPRA fine per violation?
As of 2026, about $2,663 per negligent violation and $7,988 per intentional violation, adjusted for inflation every odd-numbered January by the California Privacy Protection Agency (CPPA).
Is a violation involving a child's data always treated as intentional?
Yes. A violation involving the personal information of a consumer the business knew was under 16 is subject to the higher, intentional-violation fine amount regardless of actual intent.
Are fines calculated per business or per affected consumer?
Per violation, and violations are generally counted per affected consumer — so a single practice that violates the law for thousands of consumers can multiply into a very large total exposure.
Is there still a 30-day cure period before a fine can be issued?
No. The CPRA eliminated the automatic 30-day cure period for Attorney General and CPPA enforcement actions, effective January 1, 2023. There's no guaranteed grace period to fix a violation before facing a fine.
Who enforces CPRA fines?
Both the California Attorney General and the California Privacy Protection Agency (CPPA) can bring enforcement actions and pursue civil penalties.
This tool provides an educational estimate only and is not legal advice. Actual enforcement amounts depend on case-specific facts and agency discretion — consult a privacy attorney for your specific exposure.