Does it really matter though? In my experience, the CA attorney general fails to enforce even flagrant violations of the CCPA. All you get is a form letter when you report a violation.

Some examples I have collected: non-response to requests, spamming the email address used for a request, failure to disclose specific pieces of personal information, etc. The best one I had was a letter from Experian where they had everything redacted even my address.