Enforcement

The Attorney General is empowered to investigate potential violations of the Act and file actions to enforce the Act. Violators may be subject to injunctive relief, the litigation expenses of the Attorney General, civil penalties of up to $7,500 per violation, and other relief.

Private Enforcement Prohibited

The Act is not privately enforceable—only the Attorney General may enforce the Act.

Limited Safe Harbor

Until January 31, 2026, prior to bringing an enforcement action, the Attorney General must first provide a controller or processor with a warning letter identifying the specific provisions the Attorney General alleges have been violated. If, after 30 days from the issuance of the letter, the Attorney General believes the violations have not been cured, the Attorney General may proceed with the enforcement action. After January 31, 2026, the Attorney General is under no obligation to provide any warning letter to a potential violator before initiating an enforcement action.

Retaliation Prohibited

Controllers may not discriminate against a consumer for exercising any of the rights provided to that consumer under the Act. Examples of such prohibited retaliation include, but are not limited to: denying goods or services, charging different prices than what are charged to other consumers, and providing a different level of quality of goods or services to the consumer.

Note that this section does not require a controller to offer a good or service that would require a consumer’s personal data that the controller does not collect or maintain.

Waivers of Rights Unenforceable

Contracts or any other type of agreement that purports to waive or limit a consumer’s rights under the Act is void and unenforceable.

---

Disclaimer: The Attorney General’s Office (“AGO”) is providing this page as a rough guide to explore rights and obligations pursuant to the Act. In many instances, this website simplifies or rewords the provisions of the Act for comprehension and readability. The website is not intended to provide guidance as to how the AGO would enforce the Act. It is not the AGO’s intention to provide any information on this website that would conflict with the Act. The AGO offers this website as a tool for exploring the Act, but nothing on this site should be construed as legal advice for interpreting the Act or how the Act might be enforced.