State Attorney General

The chief legal officer of a U.S. state with authority to enforce state laws, including privacy and consumer protection statutes. State attorneys general play increasingly important roles in privacy enforcement as states enact comprehensive privacy laws. Under CCPA/CPRA, the California Attorney General has exclusive enforcement authority (though a new California Privacy Protection Agency now shares this role). Other state privacy laws grant attorneys general enforcement powers including investigation authority, civil penalties, and injunctive relief. Attorneys general can investigate violations, issue civil investigative demands, negotiate settlements, and file lawsuits seeking penalties and corrective action. Many privacy laws require attorneys general to provide cure periods before penalties, allowing businesses to fix violations within 30-60 days of notice. However, CPRA eliminated CCPA's cure period for many violations. Organizations should monitor enforcement priorities, guidance documents, and settlements from relevant state attorneys general. Multi-state actions coordinated by multiple attorneys general can create significant exposure, making proactive compliance crucial.