Penalty tables look straightforward. A statute lists a maximum dollar figure, you note it, and consider it your exposure. However, several assumptions about state privacy enforcement continue to circulate among legal and compliance teams. While the tables are accurate to an extent, they don't account for how a regulator might count violations, and that's where the real financial risk lies.
Here are five myths to reconsider before your next risk assessment.
Myth 1: "The per-violation cap is the maximum I can owe."
Reality: A per-violation cap is a unit price, not a ceiling. California's CCPA allows civil penalties of up to $2,500 per violation, or up to $7,500 for intentional acts. These figures don't indicate how many violations a single failure might produce.
Imagine a team sells personal information to a third party after an individual opts out. The business might see this as one violation: one process error, one transfer. A regulator could argue that each data subject whose information was sold is a separate violation. Multiply the per-violation figure by the number of affected individuals, and the incident's financial impact changes dramatically. Courts will ultimately decide whether repeated acts constitute a single violation or many. Until then, your exposure model should consider both possibilities.
Myth 2: "Colorado's cap makes it the safest state to get wrong."
Reality: Colorado's CPA allows penalties of up to $20,000 per violation, the highest per-violation figure among the states in this comparison. The statute also includes a $500,000 maximum for related violations, which some see as a safety net.
Two points of caution. First, the cap applies to related violations, raising the question of what makes violations "related." This is another counting issue, and it's unresolved. Second, a $500,000 ceiling is still significant for many businesses, on top of investigation, remediation, and reputational costs. Colorado's aggregate limit is useful for modeling, but it's not a reason to deprioritize compliance.
Myth 3: "Only one agency matters per state."
Reality: Enforcement authority is more fragmented than tables suggest. In Connecticut (CTDPA), Utah (UCPA), and Virginia (VCDPA), the Attorney General is the enforcing authority. California is different. Under the CPRA, both the California Privacy Protection Agency and the Attorney General can enforce actions. Colorado goes further: the Attorney General or District Attorneys may enforce the CPA.
For your team, this means preparing for different authorities. A dedicated privacy agency might focus on consent failures, while a District Attorney may view it through a local lens. Map the enforcer for each state where you operate, and ensure your response protocols can handle multiple authorities.
Myth 4: "Intent only matters in California, so it's a California problem."
Reality: It's true that California is the only state in this comparison with an enhanced penalty tier for intentional acts, up to $7,500 under both the CCPA and CPRA. Colorado, Connecticut, Utah, and Virginia don't list a separate enhanced tier.
However, the absence of a formal enhancement doesn't eliminate intent from consideration. Utah and Virginia already have a $7,500 per-violation maximum without requiring intent. In any enforcement discussion, evidence that your team knew about a defect and ignored it will influence how a regulator views the conduct. Your documentation of known issues, remediation timelines, and deferred fixes is crucial. A known, unremedied opt-out failure can escalate a negotiable matter into an aggressive one, regardless of the statute's penalty structure.
Myth 5: "Our compliance posture should be set to the lowest-penalty state."
Reality: Penalty maximums vary significantly. Connecticut tops out at $5,000 per violation, while Utah and Virginia are at $7,500, California at $2,500 or $7,500, and Colorado at $20,000. It's tempting to align your program with the least expensive jurisdiction and accept the risk elsewhere.
This approach fails for businesses with a national presence. A single Consent Management Platform configuration, opt-out workflow, and data-sale process typically serve users across all these states. You can't practically maintain five tiers of compliance on one system. The sensible approach is to design for the most stringent requirement and apply it uniformly. The lowest-penalty state indicates potential costs there, but not how your architecture should be structured.
What to do instead
Replace the penalty table with a counting model. For each type of privacy failure you might face, such as ignoring an opt-out, mishandling withdrawal of consent, or sharing data after a user declines, document three things:
- The narrow count. What is the best-case scenario, where the failure is one violation?
- The broad count. What is the regulator-friendly scenario, where each affected individual is a separate violation?
- The affected population. How many individuals could realistically fall within the broad scenario?
Then calculate against each state's per-violation maximum and, in Colorado, the related-violation cap. The gap between your narrow and broad figures is your counting risk, guiding where to invest first.
Next, reduce the population of potentially affected individuals by fixing processes that amplify a single error. Opt-out signals should propagate to downstream recipients quickly and verifiably. Keep records showing when a preference was captured and honored, as these timestamps are your defense in scope disputes.
Finally, brief your team on the enforcement map. Know whether you'd be dealing with an Attorney General, a District Attorney, or the California Privacy Protection Agency, and rehearse the response. The dollar figures in the statutes are just the starting point. How a regulator counts determines the final cost.
