As of the CCPA’s January 1, 2020, implementation date, California consumers have a private right of action for data breaches, with the possibility of eye-opening statutory damages. This article analyzes the requirements for bringing a lawsuit and, with input from lawyers at Perkins Coie and Skadden, provides steps to avoid data breach claims. It also describes ways that plaintiffs’ lawyers are likely to circumvent the law and describes the law’s provision for curing breaches, which may be more likely to fuel court arguments than curb them. See “Measures for Resolving Business Disputes Over Data Privacy and Security” (Sep. 19, 2018).