Chapter 6: State Comprehensive Privacy Laws
Enforcement - Penalties and Enforcers
The state attorney general has sole or joint enforcement power in every state; California adds the CPPA. Penalty caps vary: California $2,500 (up to $7,500 intentional), Utah and Virginia $7,500/violation, Colorado up to $20,000 (deceptive trade practice), Connecticut up to $5,000 per willful violation.
| State | Penalty per violation | Enforcer |
|---|---|---|
| California | Up to $2,500 (up to $7,500 intentional) | Attorney general AND the CPPA |
| Virginia | Up to $7,500 | Attorney general (sole) |
| Utah | Up to $7,500 | Attorney general (sole) |
| Colorado | Up to $20,000 (deceptive trade practice) | Attorney general AND local district attorneys |
| Connecticut | Up to $5,000 per willful violation (unfair trade practice) | Attorney general with the Division of Consumer Protection |
Colorado's $20,000 is the high cap
Colorado has the highest stated penalty cap ($20,000), treating violations as deceptive trade practices. Note Utah and Virginia both cap at $7,500 and have sole AG enforcement, while Colorado uniquely adds local district attorneys.
Key terms - quick answers
What is “Cure period”?
A set number of days an enforcer must give a business to fix a violation before sanction; present in some states, expired or absent in others.