When the CCPA was first enacted, it was seemingly clear that its right to private action would be limited to traditional data breaches. Over the past two years, however, some courts have called this interpretation into question by expanding the CCPA’s private right of action clause beyond the traditional breach scenario—and instead into alleged privacy violations. A recent holding from the Northern District of California could signal that more of those claims could be tacked onto the wiretap cases that are already flooding dockets.
In many ways, Allison v. PHH Mortgage is a fairly standard website tracking case predicated on allegations that tracking devices on a business’s website disclosed users’ personal information without their knowledge or consent. However, in addition to CIPA, ECPA, and the usual accompanying claims, the plaintiffs also brought a claim under the CCPA. On March 27, 2026, the Northern District of California denied PHH Mortgage’s motion to dismiss the CCPA claim, finding that the express language of the statute does not limit private rights of action to traditional data breaches. The court held that “[n]othing in the plain language of the provision limits its application to data breaches by third parties.” Instead, the court held that the CCPA’s private right of action covers unauthorized disclosure of personal information regardless of whether the disclosure was intentional or negligent, and regardless of whether it was made by a third party or the business’s own agents.
Although earlier cases such as Shah v. Capital One Financial Corp. and M.G. v. Therapymatch Inc. came to similar outcomes, the Allison holding shows that courts continue to consider broadening the scope of the CCPA’s private right of action and that they will do so with more reasoned opinions. Businesses with an online presence should take time to audit their use of third-party tracking technologies and privacy disclosures now to help ensure privacy compliance and make conscious decisions regarding risk moving forward.