California has the most comprehensive privacy law in the United States. The California Consumer Privacy Act (CCPA) went into effect on January 1, 2020, and regulates any “business” that does business in California. The CCPA provides consumers in California with greater control over data that companies collect about them. Moreover, section 1798.150(a)(1) of the CCPA provides a private right of action to “[a]ny consumer whose nonencrypted and nonredacted personal information…is subject to an unauthorized access and exfiltration, theft, or disclosure” as a result of a business failing to satisfy “the duty to implement and maintain reasonable security procedures and practices.” Damages available for a private right of action under section 1798.150(a) (1) include a statutory amount between $100 and $750 “per consumer per incident or actual damages, whichever is greater,” as well as injunctive or declaratory relief and “any other relief the court deems proper.”