Question 1

How much can I recover from a data breach settlement under CCPA §1798.150?

Accepted Answer

California Civil Code §1798.150 provides statutory damages of $100 to $750 per consumer per incident, with no requirement to prove identity theft or financial loss. Most companies settle in the $500–$2,500 range per case to avoid $5,000+ in arbitration fees.

Question 2

Do I need a lawyer to file a CCPA private right of action?

Accepted Answer

No. CCPA §1798.150 was designed for pro se consumer enforcement. Breach Bounty drafts the Formal Notice of Intent to Sue using Claude Sonnet 4.5, generates a signed PDF, and delivers it to the Chief Privacy Officer by email or USPS certified mail.

Question 3

Which US states and Canadian provinces are covered?

Accepted Answer

Nine statutes across North America: CCPA (California), BIPA (Illinois), MHMDA (Washington), SHIELD Act + GBL §349 (New York), Chapter 93A (Massachusetts), Texas DTPA, federal FCRA §1681n (United States), PIPEDA §16 (Canada), and Law 25 (Québec).

Question 4

Does Breach Bounty actually send the letters?

Accepted Answer

Yes. Every case is auto-drafted, content-verified, and delivered via SMTP directly to the company's Chief Privacy Officer. Certified mail via USPS (Lob integration) is available when a postal API key is configured. Every delivery is stamped with real provider IDs and timestamps.

Question 5

How much does Breach Bounty cost?

Accepted Answer

Free to file. The platform charges a 20% royalty only on money you actually recover. If you don't settle, you owe nothing. Royalty is collected via Stripe once a case enters SETTLED status.

Question 6

What's the difference between CCPA, BIPA, and FCRA claims?

Accepted Answer

CCPA ($100–$750) applies to California residents when a company fails to implement reasonable security. BIPA ($1,000 negligent, $5,000 intentional) applies in Illinois when biometric identifiers are collected or disclosed without consent. FCRA §1681n applies federally when a furnisher wilfully violates the Fair Credit Reporting Act — minimum $100, uncapped punitive damages. Breach Bounty routes each breach to the best-fit statute automatically.