California privacy regulators issue record CCPA settlements

California regulators have issued more consumer privacy penalties in 2026 than in all previous years combined. Five settlements under the California Consumer Privacy Act (CCPA) announced through September 29, 2026, total $17.1 million, more than doubling the $7.9 million collected from nine settlements between 2022 and 2025.

A recurring issue in these enforcement actions is the failure of businesses to provide functional methods for consumers to opt out of the sale or sharing of their personal data. Of the 14 CCPA settlements reviewed since the program began in 2022, 12 involved problems with how businesses handled opt-out requests.

The largest single penalty is a $12.75 million settlement with General Motors, announced in May 2026. State officials stated the company sold the names, contact information, location, and driving data of hundreds of thousands of Californians to data brokers without providing required notice. This settlement accounts for approximately three-quarters of the total penalties issued so far this year.