When Does the California Consumer Privacy Act Apply?
Meta description: Learn when the California Consumer Privacy Act (CCPA) applies, which businesses it covers, how its thresholds work, and what exemptions may affect a company’s obligations.
The California Consumer Privacy Act (CCPA) applies to certain for-profit businesses that collect personal information about California residents and meet specific legal criteria. The law, as amended by the California Privacy Rights Act (CPRA), can cover companies based outside California, as well as employee and business-to-business information. Whether it applies depends on a company’s business activities, relationship to California, and revenue or data practices—not simply its location or size.
The Basic Test for CCPA Coverage
A business generally falls within the CCPA when it is a for-profit legal entity that does business in California, determines the purposes and means of processing personal information, and meets at least one of the law’s coverage thresholds. These requirements work together: meeting a threshold alone does not automatically make every organization subject to the law.
“Does business in California” is not limited to having a California office or storefront. A company located elsewhere may have California customers, advertise or sell to people in the state, or otherwise conduct commercial activity there. The law does not provide a simple geographic checklist for every situation, so companies may need to assess their actual business activities and legal circumstances.
The CCPA primarily regulates businesses. It also imposes requirements on certain service providers, contractors, and other third parties that process personal information for a covered business. Those entities generally have contractual and use-related obligations, but they are not automatically covered businesses simply because they handle data.
Three CCPA Business Thresholds
A qualifying business must meet at least one of the following thresholds. The thresholds are alternatives, not cumulative requirements.
- Annual gross revenue: The business has annual gross revenues above the statutory threshold, which is adjusted for inflation. The original figure was $25 million; businesses should verify the current amount and the applicable measurement period in California Privacy Protection Agency (CPPA) guidance.
- Personal information volume: The business buys, sells, or shares the personal information of at least 100,000 California consumers or households in a year. “Sharing” generally concerns disclosure for cross-context behavioral advertising, whether or not money changes hands.
- Revenue from selling or sharing: At least 50% of the business’s annual revenue comes from selling or sharing consumers’ personal information.
The 100,000-person threshold replaced an older 50,000-person threshold. The law also expanded the relevant activity to include sharing, not just selling. Companies should therefore review current practices rather than rely on summaries written under the original version of the CCPA.
How to Interpret the Revenue Threshold
The revenue test uses gross revenue, not profit. The statutory amount is subject to periodic inflation adjustment, so the original $25 million figure should not be treated as a permanent cutoff. A company near the threshold should check the latest CPPA regulations or official announcements and document which reporting period and calculation it used.
The statute also addresses relationships among businesses. In some circumstances, a parent company, subsidiary, or other entity under common ownership or control may be treated as a covered business when it shares common branding and personal information with a business that meets the CCPA criteria. Corporate structure alone does not settle the question; the applicable statutory conditions matter.
What Counts as Personal Information?
CCPA personal information generally means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, to a consumer or household. It can include information maintained in digital or other formats. A company does not need to collect a person’s name to handle personal information.
Examples include names, postal addresses, email addresses, account identifiers, IP addresses, online activity, purchase history, precise geolocation, and certain inferences drawn from other information. The definition can also cover information associated with a household or device. Publicly available information and certain legally defined categories are excluded, but organizations should not assume that information is exempt merely because it is online or pseudonymous.
In many cases, data held by a vendor or collected through a website, mobile app, advertising technology, or customer platform can be relevant to the analysis. Businesses should map information flows, including information collected on their behalf, rather than look only at data stored in their own systems.
Who Is a California Consumer?
The law protects California residents, including people who are temporarily outside the state but remain California residents under the applicable legal definition. It is not restricted to adults, customers, or people who directly provide information. A person may be a consumer even when information is collected passively through a device or obtained from another source.
Since January 1, 2023, the CCPA’s consumer protections have applied broadly to personal information in employment and business-to-business contexts. The former temporary exclusions for many employee, applicant, and business contact records expired. As a result, a covered business may have obligations concerning job applicants, employees, contractors, and individuals acting for another business, subject to the law’s specific provisions and applicable exemptions.
Does the CCPA Apply to Small Businesses?
Some small businesses are covered, while others are not. A small company may fall outside the law if it does not meet any of the thresholds and is not otherwise brought within scope through a relevant corporate relationship. However, a modest-sized company can still qualify if its data practices meet the volume or revenue-from-selling-or-sharing test.
There is no general exemption simply because a business has few employees, operates online, or is privately held. Likewise, a company cannot assume it is outside the law because it has no California headquarters. The practical assessment should consider California activity, revenue, the number of consumers or households whose information is bought, sold, or shared, and any ownership or control relationships.
Common CCPA Exemptions and Limits
The CCPA contains exemptions for particular information or processing contexts. Many are data-specific rather than blanket exemptions for an entire organization. A business that handles some exempt data may still have CCPA duties for other personal information.
- Medical information: Certain information governed by the Health Insurance Portability and Accountability Act (HIPAA) or the California Confidentiality of Medical Information Act may be exempt in specified circumstances.
- Financial information: Certain personal information subject to the Gramm-Leach-Bliley Act (GLBA) is exempt under the CCPA’s provisions.
- Credit reporting: Certain information regulated by the Fair Credit Reporting Act (FCRA) may be exempt when the statutory conditions apply.
- Other regulated data: The law contains limited exclusions for certain information covered by specific federal or state statutes, as well as particular research, legal, or operational contexts.
These exceptions should be read narrowly and in context. For example, a financial institution should not assume that every piece of information it holds is outside the CCPA simply because some records are subject to the GLBA. The purpose of processing, type of data, and relevant legal requirements can affect the result.
Separate from exemptions, the CCPA includes exceptions that may permit particular uses or disclosures—for example, to comply with legal obligations, protect security, or complete a transaction requested by a consumer. Such exceptions do not necessarily remove a business from the law or eliminate all of its privacy obligations.
What “Selling” and “Sharing” Mean
CCPA coverage can depend on whether a company sells or shares personal information. “Selling” is broader than a conventional cash sale: it can include making personal information available to another business or third party for monetary or other valuable consideration, subject to statutory conditions and exceptions.
“Sharing” generally concerns making personal information available to a third party for cross-context behavioral advertising, even when no money is exchanged. Advertising pixels, cookies, mobile identifiers, and data-sharing arrangements may warrant review. The legal classification depends on the facts, including the parties’ roles, contracts, and how information is used.
A company’s characterization of a vendor as an “analytics provider” or “advertising partner” does not decide the legal question. Businesses should examine the actual data flows and contractual terms, including whether the recipient may use information for its own purposes or combine it with information from other sources.
What Covered Businesses Must Do
When the CCPA applies, a business may need to provide clear privacy notices, explain categories of personal information collected and purposes of use, and offer required methods for consumers to exercise their rights. Depending on the circumstances, those rights may include requesting access, correction, or deletion; opting out of sale or sharing; and limiting certain uses or disclosures of sensitive personal information.
Businesses must also meet requirements for handling consumer requests, maintaining appropriate records, and managing disclosures to service providers, contractors, and third parties through compliant contracts. The law restricts discrimination against consumers for exercising their rights, while allowing certain differences in service or price where legally permitted and properly explained.
Some covered businesses must recognize opt-out preference signals, such as qualifying browser-based signals, and may have additional obligations under CPRA amendments and CPPA regulations. Requirements can vary by data type and business activity, so a generic privacy policy may not be enough to demonstrate compliance.
A Practical CCPA Applicability Checklist
- Confirm California business activity. Review sales, services, marketing, website operations, and other commercial activity involving California.
- Identify the legal entity and its role. Determine whether it is a for-profit business deciding why and how personal information is processed, or a service provider or contractor acting for another entity.
- Calculate annual gross revenue. Compare the appropriate figure with the current inflation-adjusted threshold using reliable financial records.
- Measure consumer and household data activity. Count the California consumers or households whose personal information the business buys, sells, or shares during the relevant year.
- Review revenue sources. Determine whether 50% or more of annual revenue comes from selling or sharing personal information.
- Assess corporate relationships. Check ownership, control, common branding, and information-sharing arrangements with affiliated businesses.
- Classify data and exemptions. Separate potentially exempt information from information that remains covered, and document the legal basis for any exemption.
Coverage is not always a one-time determination. Revenue, advertising technology, data volumes, acquisitions, and corporate structures can change. Reviewing the analysis periodically—and whenever a major business or data practice changes—helps reduce the risk of relying on outdated assumptions.
Where to Verify Current Requirements
The CPPA publishes regulations, rulemaking materials, and guidance relevant to California privacy requirements. The California Attorney General’s CCPA resources also explain consumer rights and business responsibilities. For statutory text, businesses can consult the California Legislative Information website.
- California Privacy Protection Agency regulations
- California Attorney General: CCPA information
- California Civil Code, Title 1.81.5
These resources are useful starting points, but they do not replace a fact-specific legal analysis. A business with complex data practices, multiple affiliates, or potentially applicable exemptions may need advice from qualified privacy counsel.