Judge David O. Carter, in the Central District of California, made the following findings on a motion to dismiss:

  • the CCPA is not retroactive despite allegations of an ongoing pattern and practice;
  • the CCPA does not include a private right of action for “§§ 1798.100(b), 110(c), and 115(d)”;
  • the “disclosure of consumers’ non-anonymized data was not a result of a failure to implement and maintain reasonable security measures, but was a business decision to combat retail fraud. As such, the provision is inapplicable because it is not alleged that [defendants] violated their duties as they relate to security procedures and practices”; and
  • CCPA only applies to California residents and cannot be used by out-of-state plaintiffs.


Hayden v. Retail Equation, No. 8:20-cv-01203-JWH-DFMx, at *7-8 (C.D. Cal. May 4, 2022).