CCPA slaps penalties