The decisions represent a sharp departure from prior precedent. Earlier courts, including Judge Carter in 2022, had limited CCPA's private right of action to breaches involving unencrypted or unredacted personal information, dismissing claims based on notice violations or other non-breach conduct. These new rulings instead rely on the CCPA's broad definition of "personal information" and its consumer autonomy purpose to permit claims for unauthorized access, exfiltration, or disclosure through tracking mechanisms. The exact scope of what conduct now qualifies remains unsettled as courts work through the implications.
Companies using tracking technologies should prepare for expanded litigation exposure. These rulings signal a departure from the breach-only framework that has governed CCPA enforcement for years. Combined with heightened regulatory activity in 2026—including recent enforcement actions like the Ford fine—the decisions create material risk for any business collecting or sharing consumer data through third-party tracking tools without explicit consent. Counsel should audit current tracking practices and consent mechanisms now.