CCPA Cure Notice: Can You Fix a Violation Before Getting Fined?

What Is a Cure Notice Under the CCPA?

A cure notice is a written notification from the California Attorney General (or a private plaintiff) alleging that your business has violated the California Consumer Privacy Act (CCPA). It gives you 30 days to "cure" the alleged violation—meaning you fix the issue and provide a written statement that the violation has been resolved and will not recur. If you cure within that window, you generally avoid liability for civil penalties or damages. But here's the catch: the cure right is not guaranteed forever, and it's being phased out under the CPRA.

The 30-Day Cure Period: How It Works

When you receive a cure notice, the clock starts ticking. You have 30 calendar days to:

• Identify the specific violation (e.g., missing privacy notice, failure to honor opt-out, data breach notification delay).
• Implement corrective measures (update your privacy policy, fix data deletion processes, etc.).
• Send a written statement to the notifying party confirming the cure and describing the steps taken.

If you do all that, the AG or plaintiff cannot pursue civil penalties for that specific violation. But note: the cure must be complete and in good faith. Half-fixes won't cut it.

When the Cure Notice Doesn't Apply

Not all violations are curable. For example, if you've already suffered a data breach and exposed sensitive personal information, you can't un-ring that bell. The cure notice is meant for procedural or technical violations—like failing to have a proper privacy policy or not responding to consumer requests within the required timeframe. Also, the cure right does not apply to private rights of action for data breaches under CCPA Section 1798.150. In those cases, consumers can sue directly without giving you a chance to cure.

The CPRA Changes: Cure Notice on the Chopping Block

The California Privacy Rights Act (CPRA), which went into effect on January 1, 2023, significantly weakens the cure notice. Under the CPRA, the cure period is only temporary—it sunsets on January 1, 2024, unless the California legislature extends it. After that, the AG can seek penalties without giving you a 30-day warning. The CPRA also allows the AG to consider the cure notice as a factor in determining penalties, but it's no longer a safe harbor. So if you're relying on the cure notice as a safety net, you're playing with fire.

Practical Tips: Don't Rely on the Cure Notice

Think of the cure notice like a fire extinguisher: it's great to have, but you don't want to start a fire just because you have one. The best strategy is to be proactive. Conduct regular privacy audits, update your policies, and train your staff. If you do get a cure notice, treat it as a serious warning—not a free pass. And remember, the cure notice only applies to CCPA violations, not other laws like the GDPR or state breach notification laws.

FAQ