California

Tier 1 Comprehensive law United States

California is the substantive centre of gravity of US state privacy law. Under the patchwork (no-floor) US model, California legislates independently and does not displace any federal default — there is no comprehensive federal consumer privacy statute to displace. Its distinguishing features are a dedicated regulator (the CPPA) and a limited private right of action, neither of which most other states have. displacesFederal is FALSE precisely because there is no federal default to override; the state simply occupies the field itself.

At a glance

Principal law: CCPA as amended by CPRA (Cal. Civ. Code sec. 1798.100 et seq.)
Regulator: California Privacy Protection Agency (CPPA) and California Attorney General
Maximum penalty: $2,500 per unintentional / $7,500 per intentional or minor-related violation; private statutory damages $100-$750 per consumer per breach incident

How it relates to the national law

Model: fully-independent
Displaces national law: No
Parent jurisdiction: United States

Independently substantive. There is no national floor to derogate from, so this act stands on its own — its thresholds, rights and enforcement are its own.

Regulators

California Privacy Protection Agency CPPA
Dedicated privacy regulator with rulemaking, investigation and audit powers.
California Attorney General
Concurrent civil enforcement.

Instruments

CCPA/CPRA

Tier 1

Cal. Civ. Code sec. 1798.100 et seq.

Sources

Secondary What Is the CCPA? California Consumer Privacy Act Cyberhaven

Never independently verified — seeded from the prototype.