Actual legal text on CA data breach law from the following link. Notification requirements are near the bottom, starting with the section labeled "(j) For purpo

Actual legal text on CA data breach law from the following link. Notification requirements are near the bottom, starting with the section labeled "(j) For purposes of this section, “notice” may be provided by one of the following methods:" https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.82 https://leginfo.legislature.ca.gov/faces/codes_displaySectio... Email notice is an option if meeting the restrictions listed in the Federal law linked below. I think the relevant part is section (c), with the major restriction being "affirmative consent." https://www.law.cornell.edu/uscode/text/15/7001 https://www.law.cornell.edu/uscode/text/15/7001 Alternatively if the breach affects over half a million people, they can send notifications by email, but also have to plaster their homepage and send "Notification to major statewide media." The homepage banner would only affect people who pay electronically but not by autopay. There are ways to minimize the effect of news broadcast, e.g. send the press release at 4 o'clock on a Friday when no one watches the news. So, it's not quite as easy as you think but Comcast does have options to minimize the impact of notification.