In Gardiner v. Walmart Judge Koh held that the CCPA was not retroactive.
The CCPA went into effect on January 1, 2020, and it does not contain an express retroactivity provision. See Cal. Civ. Code § 1798.198 (providing the CCPA “shall be operative January 1, 2020); see also Cal. Civ. Code § 3 (“[n]o part of [this Code] is retroactive, unless expressly so declared.”). Moreover, it is well-settled under California law that “in the absence of an express retroactivity provision, a statute will not be applied retroactively unless it is very clear from extrinsic sources that the Legislature must have intended a retroactive application.” See, e.g., People v. Brown, 54 Cal. 4th 314, 319-20 (2012); Aetna Cas. & Sur. Co. v. Indus. Acc. Comm’n, 30 Cal. 2d 388, 393 (Cal. 1947). Based on the text of the statute and California law, the Court concludes that the challenged provision of the CCPA does not apply retroactively. Accordingly, the alleged breach here is only actionable under the CCPA if it occurred after January 1, 2020. Plaintiff does not dispute that the CCPA does not apply retroactively, and he concedes that he has not alleged the specific date of the breach. (See Opp. at 6 (“[H]e cannot say specifically when Defendant’s system was breached.”).) Plaintiff argues, however, that his allegation that his personal information is currently available on the dark web satisfies his pleading obligation. The Court disagrees. In order to have a viable claim against Walmart for a violation of the CCPA, Plaintiff must allege that Walmart’s “violation of the duty to implement and maintain reasonable security procedures and practices” that led to the breach occurred on or after January 1, 2020. See Cal. Civ. Code § 1798.150(a)(1). Plaintiff has not done so. Although Plaintiff alleges that unnamed third-party criminals are currently circulating his personal information on the dark, he does not allege that the breach of Walmart’s website—the relevant conduct—occurred no earlier than January 1, 2020. Absent allegations establishing that Walmart’s alleged violation of the CCPA occurred after it went into effect, Plaintiff’s CCPA claim is not viable.