Statute Annotations › California › Cal. Civ. Code § 1798.100

Cal. Civ. Code § 1798.100

Consumers' right to know and opt out: the cases that interpreted this section

Jurisdiction
California
Case notes
6
Cited in passing
19
Citing cases indexed
25
Case dates
2023–2024
Screened through
2026-03-12
Courts' treatment: live
No reviewed case has held this section invalid, preempted, superseded or repealed.
This reflects what the reviewed cases said, not legislative action: a later amendment or repeal by the legislature would not appear here unless a reviewed case discussed it.

25 citing cases reviewed: 6 interpreted the section (annotated below), 19 cited it only in passing. Cases filed after 2026-03-12 may not have been reviewed yet.

Have a situation under Cal. Civ. Code § 1798.100?

These notes show how courts have ruled. Ask about your specific facts and see which of these rulings apply, with citations you can check.

California Consumer Privacy Act

Section 1798.100 governs the disclosure and security of personal information.

Rosado v. Zuckerberg · filed 2023-09-11§ 1798.100

which governs the disclosure and security of personal information.
Read the full opinion on CourtListener →

Section 1798.100(e)'s security-protection requirement does not apply to a HIPAA-covered entity because § 1798.145(c)(1)(A) exempts such entities.

Tate v. EyeMed Vision Care, LLC · filed 2023-09-29(e)

Once again, the statute does not cover EyeMed’s conduct—this time because EyeMed is a covered entity subject to HIPAA.
Read the full opinion on CourtListener →

Section 1798.100(e) cannot serve as the basis for a private CCPA cause of action because the private-action provision applies only to violations defined in section 1798.150(a), not violations of other title provisions.

M.G. v. Therapymatch, Inc. · filed 2024-09-16(e)

The CCPA explicitly states in section 1798.150 that “[t]he cause of action established by this section shall apply only to violations as defined in subdivision (a) and shall not be based on violations of any other section of this title.” ... Accordingly, the Court DISMISSES with prejudice M.G.’s CCPA claims brought under sections 1798.100 and 1798.81.5.
Read the full opinion on CourtListener →

Reasonable Security Procedures

Section 1798.100(e) requires a business to implement reasonable security procedures and practices to protect consumers’ personal information.

Diep v. Apple, Inc. · filed 2024-03-27(e)

“implement reasonable security procedures and practices” to protect the personal information of App Store users.
Read the full opinion on CourtListener →

Section 1798.100(a)(1) requires online providers to inform users of the categories of personal information they will collect and the purposes of collection.

Netchoice, LLC v. Bonta · filed 2024-08-16(a)(1)

The CCPA requires, among other things, that online providers inform users of the categories of personal information to be collected and the purposes of such collection.
Read the full opinion on CourtListener →

Section 1798.100 requires businesses that collect a consumer's personal information to implement reasonable security procedures and practices appropriate to the information's nature to protect it from unauthorized or illegal access, destruction, use, modification, or disclosure.

Keown v. International Association of Sheet Metal Air Rail Transportation Workers · filed 2024-09-19§ 1798.100

The CCPA requires “business[es] that collect[] a consumer’s personal information [to] implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure[.]”
Read the full opinion on CourtListener →
19 more cases cited this section only in passing

These cases mention the section without interpreting it (a string cite, a footnote, background). Listed so you can see the full citation record, not just the annotated rulings.

(PS) Lewis v. AT&T, the opinion only identifies sections 1798.100 et seq. as a possible state-law claim and discusses the absence of federal-question or diversity jurisdiction; it does not construe or apply what § 1798.100 means or requires. opinion →
Voodoo SAS v. SayGames LLC, the opinion mentions Cal. Civ. Code § 1798.100 et seq. only to identify a privacy-policy section addressing CCPA requirements, as part of the personal-jurisdiction analysis; it does not interpret, apply, or state what the statute means or requires. opinion →
K. v. Google LLC, the opinion mentions Cal. Civ. Code § 1798.100 only as a statute the plaintiff claimed to have alleged violations of, then observes that no such claim was asserted against the District; it does not explain or apply what the statute means or requires. opinion →
Katz-Lacabe v. Oracle America, Inc., the opinion mentions Cal. Civ. Code §§ 1798.100 et seq. only as a comparison supporting the general observation that California has enacted substantive data-privacy legislation; it does not interpret, apply, or explain what § 1798.100 requires or does. opinion →
Alexander v. Wells Fargo Bank, N.A., the opinion identifies the CCPA by citing § 1798.100 et seq. and recounts the plaintiff's allegations and the court's prior procedural ruling, but it does not state what § 1798.100 means, requires, authorizes, or how it applies. opinion →
In re CorrectCare Data Breach Litigation, the opinion mentions Cal. Civ. Code § 1798.100 only in describing that California residents would receive an additional settlement payment for CCPA statutory-damages claims; it does not interpret, apply, or explain what the statute requires or authorizes. opinion →
Shields v. Mondelez Global LLC, the opinion only lists Cal. Civ. Code § 1798.100 as a claim in the complaint and states that plaintiffs withdrew the California statutory claims; it does not interpret or apply the statute. opinion →
Flores v. Bryan Cave Leighton Paisner LLP, the opinion mentions Cal. Civ. Code § 1798.100 only in listing a California statutory claim that plaintiffs withdrew; the court does not construe, apply, or describe what the statute requires or authorizes. opinion →
Haskins v. City of Hope National Medical Center, the opinion mentions Cal. Civ. Code § 1798.100 et seq. only to identify one cause of action in the complaint and does not discuss what the statute means, requires, authorizes, or how it applies. opinion →
Houghton v. Rancho Mesquite Casino, Inc., the opinion mentions § 1798.100 only in identifying the CCPA claims as arising under Cal. Civ. Code §§ 1798.100 et seq.; its substantive CCPA analysis addresses §§ 1798.150 and 1798.81.5 instead. opinion →
Angus v. Flagstar Bank, FSB, the opinion only identifies the CCPA as one of the California statutes at issue and leaves the claims unresolved, denying dismissal without prejudice and allowing renewed briefing; it does not explain what § 1798.100 means, requires, authorizes, or how it applies. opinion →
WEST v. GLOBAL LENDING SERVICES, LLC, the opinion cites § 1798.100 only as part of the CCPA citation and discusses other provisions (§§ 1798.110, 1798.115, 1798.130, and 1798.140), without stating what § 1798.100 itself means, requires, authorizes, or how it applies. opinion →
Gutierrez v. Converse Inc., the concurrence mentions § 1798.100 only while identifying the CCPA as a possible source of recourse and listing businesses' disclosure duties; it does not decide or apply the meaning or operation of § 1798.100. opinion →
BIANUCCI v. RITE AID CORPORATION, the opinion mentions § 1798.100 only as part of the plaintiffs’ list of California Consumer Privacy Act claims and refers generally to California law providing statutory damages; it does not state what § 1798.100 means, requires, authorizes, or how that section applies. opinion →
Baysal v. American Family Life Insurance Company, the opinion mentions Cal. Civ. Code § 1798.100 et seq. only in describing the claims alleged in the complaint; it does not interpret, apply, or state what the statute requires or means. opinion →
Chien v. Bumble Inc., the statute appears only in the opinion's background list of claims asserted in the complaint. The court did not construe, apply, or decide anything about Cal. Civ. Code § 1798.100. opinion →
Ramos v. Wells Fargo Bank, N.A., section 1798.100 appears only in the opinion’s list of claims as part of the CCPA’s statutory range. The court did not construe or apply § 1798.100; its CCPA analysis addressed § 1798.150(a)(1) and § 1798.82(a) instead. opinion →
Netchoice, LLC v. Bonta, the court cites § 1798.100 only as part of the CCPA statutory range in a background footnote describing the CAADCA's incorporation of CCPA definitions; it does not interpret, apply, or decide anything about § 1798.100 itself. opinion →
Troester v. Starbucks Corporation, the concurrence cites the Act as background to a discussion of employee monitoring; it does not decide § 1798.100’s rules. opinion →

Which of these rulings fit your facts?

Describe your situation under Cal. Civ. Code § 1798.100. Ezel checks it against the cases on this page and answers with citations.

Opens in Ezel Pro.

  • Checks the law as it stands today, not only this page
  • Cites every source it relies on, so you can verify it
  • Chat, drafting and research in one workspace