California Consumer Protection Act: CLRA, UCL, FAL, and CCPA

There is no single statute called the California Consumer Protection Act. California instead protects consumers through four overlapping laws: the Consumers Legal Remedies Act (CLRA), the Unfair Competition Law (UCL), the False Advertising Law (FAL), and the California Consumer Privacy Act (CCPA). Each covers different conduct and offers different remedies, so the law that applies to your situation determines what you can actually recover.

The Four Laws at a Glance

The CLRA is the go-to statute when a business misleads you in a specific purchase or service transaction. The UCL is broader and reaches any unlawful, unfair, or fraudulent business practice, but its private remedies are limited. The FAL targets false advertising and carries criminal penalties. The CCPA protects your personal data and lets you sue in one narrow situation. Plaintiffs often invoke more than one at the same time because the statutes were built to work together.

The Consumers Legal Remedies Act

The CLRA, starting at Civil Code section 1750, covers purchases and leases of goods and services for personal, family, or household use.1California Legislative Information. California Code Civil Code 1750 – Consumers Legal Remedies Act “Goods” includes physical items you buy or lease for personal use, and even items that get permanently attached to real property such as built-in appliances. “Services” means work and labor performed for non-commercial purposes, including services connected to selling or repairing goods.2California Legislative Information. California Code Civil Code 1761

The CLRA only protects individuals acting as consumers. Buying inventory for a business or leasing commercial equipment falls outside it. The transaction does not need to be a formal contract — any agreement between you and the business counts.2California Legislative Information. California Code Civil Code 1761

What the CLRA Prohibits

The statute lists twenty-nine categories of deceptive or unfair conduct that businesses cannot use in consumer transactions.3California Legislative Information. California Code CIV 1770 The prohibitions most commonly invoked include:

  • Claiming goods have a sponsorship, approval, certification, quality, or grade they don’t actually have.
  • Representing products as new when they’ve been altered, reconditioned, or previously used.
  • Advertising goods or services with no real intention of selling them as advertised.
  • Advertising products without intending to meet reasonably expected demand, unless the ad clearly discloses a quantity limit.
  • Telling you a replacement part or repair service is needed when it isn’t.
  • Inserting unconscionable provisions into a contract.
  • Making false claims about the reasons for, existence of, or amounts of price reductions.

The full list also reaches deceptive geographic origin claims, misrepresenting a salesperson’s authority to negotiate final terms, and falsely suggesting a transaction gives you rights or obligations that don’t exist.3California Legislative Information. California Code CIV 1770

The 30-Day Notice Requirement

You cannot file a CLRA damages claim without first sending the business written notice at least 30 days in advance. The notice must go by certified or registered mail with return receipt requested, addressed to either the location where the transaction happened or the business’s main California office.4California Legislative Information. California Code Civil Code 1782

The letter must identify the specific violations you’re alleging and demand that the business fix the problem. If the business provides an appropriate correction, or agrees to one, within 30 days of receiving your notice, you lose the right to sue for damages. You can still ask a court for an order stopping the deceptive practice going forward.4California Legislative Information. California Code Civil Code 1782

Deadline to File

You have three years from the date of the deceptive act to file a CLRA claim.5California Legislative Information. California Code CIV 1783 The clock runs from when the conduct occurred, not from when you discovered it, and the mandatory 30-day pre-suit notice eats into that window.

What You Can Recover

The CLRA gives courts broad authority to compensate a successful plaintiff:

  • Actual damages for the economic loss you suffered. In a class action, the total damages award must be at least $1,000.
  • Punitive damages for particularly egregious conduct.
  • Injunctive relief ordering the business to stop the deceptive practice.
  • Restitution of money or property the business obtained through the unlawful conduct.
  • Attorney’s fees and court costs, awarded automatically to a winning plaintiff.

Fee-shifting runs both ways: a defendant can recover reasonable attorney’s fees if the court finds the lawsuit was brought in bad faith.6California Legislative Information. California Code Civil Code 1780

Senior citizens and people with disabilities can recover an additional award of up to $5,000 on top of the standard remedies. You must show substantial physical, emotional, or economic harm, and the court must find the enhanced award warranted after weighing aggravating factors.6California Legislative Information. California Code Civil Code 1780

Your Rights Cannot Be Waived

Any contract provision that tries to waive your CLRA rights is void as against public policy.7California Legislative Information. California Code Civil Code 1751 If a company’s terms and conditions say you agree not to bring a CLRA claim, that clause is legally meaningless.

The Unfair Competition Law

The UCL, at Business and Professions Code section 17200, defines “unfair competition” to include any business act or practice that is unlawful, unfair, or fraudulent, plus any untrue or misleading advertising.8California Legislative Information. California Code Business and Professions Code 17200 The “unlawful” prong lets the UCL borrow violations from virtually any other state or federal law. A business that violates the CLRA, a federal consumer regulation, or an industry licensing statute has also committed unfair competition under the UCL.

To bring a private UCL claim, you must show you lost money or property because of the unfair practice.9California Legislative Information. California Code Business and Professions Code 17204 Witnessing a deceptive ad or objecting to a company’s behavior is not enough. You need a concrete financial loss tied to the conduct.

The trade-off for the UCL’s wide scope is a narrow remedy set. Private plaintiffs can obtain only injunctive relief and restitution of what the business acquired through unfair competition.10California Legislative Information. California Code Business and Professions Code 17203 No compensatory damages, no punitive damages, no attorney’s fees. That is why plaintiff’s attorneys often pair a UCL claim with a CLRA claim.

UCL claims must be filed within four years of when the cause of action arose, one year longer than the CLRA.11California Legislative Information. California Code BPC 17208

The False Advertising Law

The FAL, at Business and Professions Code section 17500, prohibits spreading untrue or misleading claims about property or services through any medium when the person knows or should know the statement is false. A violation is a misdemeanor punishable by up to six months in county jail, a fine of up to $2,500, or both.12California Legislative Information. California Code Business and Professions Code 17500 – False Advertising in General

Criminal enforcement is handled by prosecutors, not private individuals. But misleading advertising that violates the FAL also counts as unfair competition under section 17200, giving you a civil path through the UCL.

The California Consumer Privacy Act

Many people searching for California consumer protection are actually looking for the CCPA, which took effect in 2020 and was expanded by the California Privacy Rights Act. The CCPA protects your personal data rather than your purchasing decisions.

It applies to for-profit businesses operating in California that meet any one of three thresholds: more than $25 million in annual gross revenue, buying or selling the personal information of 100,000 or more California consumers or households per year, or earning at least half their revenue from selling personal information.13California Office of the Attorney General. California Consumer Privacy Act (CCPA) Meeting any single threshold triggers the full obligations.

Your Rights Under the CCPA

  • Right to know what personal information a business has collected about you, where it came from, why it was collected, and who received it. You can make this request twice per year at no cost.
  • Right to delete personal information collected from you, with limited exceptions such as legal compliance.
  • Right to opt out of the sale or sharing of your personal information, including through a browser-based global privacy control.
  • Right to correct inaccurate personal information.
  • Right to limit how a business uses sensitive information like your Social Security number, financial accounts, precise location, or genetic data.
  • Right to non-discrimination for exercising any of these rights.
13California Office of the Attorney General. California Consumer Privacy Act (CCPA)

When You Can Sue Under the CCPA

The CCPA lets you sue a business directly in one specific situation: when your unencrypted personal information is stolen in a data breach caused by the business’s failure to maintain reasonable security practices. You can recover either your actual financial losses or statutory damages between $100 and $750 per consumer per incident, whichever is greater.14California Legislative Information. California Code Civil Code 1798.150

Before suing for statutory damages, you must give the business 30 days’ written notice identifying which CCPA provisions it violated. If the business cures the violation and provides a written statement that no further violations will occur, statutory damages are off the table, though tightening security after a breach does not count as a cure for the breach that already happened.14California Legislative Information. California Code Civil Code 1798.150 You can still sue for actual monetary damages without sending the 30-day notice first.

Choosing and Combining Claims

The practical choice usually comes down to what happened and what you want to recover. If a business deceived you in a specific purchase or service transaction, the CLRA is your strongest option because it offers actual damages, punitive damages, and attorney’s fees. If the conduct is broader and does not fit neatly into the CLRA’s prohibited categories, the UCL can reach it, though your recovery is limited to getting your money back. If your personal data was compromised because a business cut corners on security, the CCPA’s private right of action is the path.

Filing under more than one statute is common. The UCL’s four-year deadline can rescue a claim that missed the CLRA’s three-year window. The CLRA’s damages and fee-shifting add real pressure to a case that would be equitable-only under the UCL. And a data breach may implicate both the CCPA and the UCL if the security failure also qualifies as unfair competition.