In 2025, the Data Breach Chronology captured 8,019 data breach notification filings from state and federal agencies that publish breach reports. These represented 4,080 unique breach events impacting at least 375 million individuals. This report examines what those 4,080 breaches tell us about the state of data security, and where the gaps in breach reporting leave consumers in the dark.
The California Consumer Privacy Act (CCPA) was the first comprehensive consumer privacy law in the United States, in effect since 2020 and broadened in 2023 by the California Privacy Rights Act. It lets Californians see, correct, and delete the personal information businesses collect about them and opt out of its sale or sharing, and it remains the only state law backed by a dedicated regulator, the California Privacy Protection Agency.