Data breach litigation in California commonly takes the form of class actions asserting violations of the CCPA's private right of action, claims under the Customer Records Act (Civil Code §1798.82), negligence, breach of contract, and unjust enrichment. Regulatory enforcement actions by the California Privacy Protection Agency (CPPA) and Attorney General can run parallel to civil suits.

The CCPA provides a private right of action for California residents whose unencrypted, unredacted personal information is subject to unauthorized access due to a business's failure to implement and maintain reasonable security. Affected consumers can recover statutory damages of $100 to $750 per consumer per incident (or actual damages, if greater) without proving actual harm.

Standing requires that a plaintiff have suffered a concrete injury. In data breach cases, courts have accepted standing based on increased risk of identity theft, out-of-pocket mitigation costs, and diminution in the value of personal information. The CCPA private right of action specifically allows statutory damages without proof of actual injury, which is a lower barrier than many other theories.

Defenses can include challenges to standing, arguments that the business implemented reasonable security practices, evidence that the breach resulted from a sophisticated, unforeseeable attack, lack of causation between the breach and claimed damages, challenges to class certification, and reliance on contractual limitation of liability provisions.

A cyber insurance tender is the formal process of notifying your insurer of a covered incident and requesting defense and indemnification. Insurance carriers often have significant influence over litigation strategy and settlement decisions. Early and complete tender — following all notice obligations in the policy — is critical to maximizing available coverage.

Class actions can take several years from filing through settlement or trial. Early settlement is common in data breach cases because of the cost of litigation, the reputational risk of prolonged proceedings, and the business interest in certainty. Individual disputes involving smaller companies may resolve faster through negotiation or arbitration.

The Illinois Biometric Information Privacy Act (BIPA) is a state law that applies to the collection and use of biometric data (such as fingerprints or facial recognition) in Illinois. While it is an Illinois law, California employers and technology companies with Illinois-based employees or customers may face BIPA exposure in addition to their California obligations.

In many cases, yes — if the business's consumer agreements include a valid class action waiver and arbitration clause. Courts have generally enforced such clauses in data breach cases, though some jurisdictions have found them unenforceable in specific contexts. Whether an arbitration agreement can defeat class certification depends on its scope, enforceability, and applicable law.