The California Consumer Privacy Act, and its private right of action, were subject to much breathless speculation in the privacy bar leading up to its January 1, 2020, effective date.

The ground-breaking law opened the door to consumer suits in instances where a business's failure to maintain reasonable security measures results in "an unauthorized access and exfiltration, theft, or disclosure" of non-encrypted personal information. With statutory damages of up to $750 dollars for each violation, some predicted a flood of CCPA litigation.