CCPA: Which Businesses Must Comply?
The three CCPA thresholds, what "selling" and "sharing" mean, who is exempt, the 2026 regulation deadlines and the current fines.
The California Consumer Privacy Act (CCPA, as amended by the CPRA) applies to a for-profit business that does business in California and meets any one of three tests: more than $26,625,000 in gross annual revenue in the prior calendar year; buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or getting 50% or more of annual revenue from selling or sharing personal information.
The three thresholds
| Test | Threshold | Notes |
|---|---|---|
| Revenue | More than $26,625,000 | Gross revenue for the prior calendar year, from all sources, not just California. Adjusted for inflation since January 1, 2025 (was $25 million). |
| Volume of data | 100,000+ consumers or households | Personal information the business buys, sells or shares each year. Collecting data for your own use doesn't count toward this test. |
| Data-driven revenue | 50%+ of revenue | From selling or sharing personal information. |
A business that meets none of the tests isn't covered by the CCPA, whatever it does with data. A company that controls or is controlled by a covered business and shares its branding, and a joint venture of covered businesses, can be covered too.
"Selling" and "sharing" are broad
Selling means giving personal information to another business for money or other valuable consideration. Sharing means giving it to a third party for cross-context behavioral advertising, which is ad targeting based on activity across other sites and apps. A website running third-party advertising pixels or cookies can be "sharing" the data of every California visitor, so a mid-sized online store can pass 100,000 consumers or households a year without selling anything in the usual sense.
Who isn't covered
- Nonprofits and government agencies, generally.
- Data already covered by other laws, such as medical information under HIPAA or California's medical privacy law, consumer report data under the Fair Credit Reporting Act, and financial data under the Gramm-Leach-Bliley Act. These are data exemptions: the rest of the business's data can still be covered.
The temporary exemptions for employee data and business-to-business contacts expired on December 31, 2022. A covered business now owes its employees, job applicants and B2B contacts the same rights as customers.
What covered businesses must do
- Post a privacy policy and give a notice at collection describing what data is collected and why.
- Honor requests to know, delete and correct personal information, and to opt out of the sale or sharing of it (including Global Privacy Control browser signals), and to limit the use of sensitive personal information.
- Put CCPA terms in contracts with service providers, contractors and third parties.
- Collect and keep only the data that's reasonably necessary, and use reasonable security.
A business that isn't covered can still owe duties as a service provider or contractor to a covered business, under its contract.
New duties from the 2026 regulations
Regulations that took effect January 1, 2026 add obligations for covered businesses, phased in by deadline:
| Requirement | Deadline |
|---|---|
| Risk assessments for high-risk processing | From January 1, 2026; attestation and summary due April 1, 2028 |
| Automated decisionmaking technology (ADMT) used for significant decisions | January 1, 2027 |
| Cybersecurity audit, revenue over $100 million | April 1, 2028 |
| Cybersecurity audit, revenue $50 million to $100 million | April 1, 2029 |
| Cybersecurity audit, revenue under $50 million | April 1, 2030 |
Risk assessments and audits apply only to businesses whose processing presents significant risk, such as selling or sharing data or processing sensitive personal information, not to every covered business.
Fines and lawsuits
The California Privacy Protection Agency and the Attorney General enforce the law. Since January 1, 2025, the maximum is $2,663 per violation and $7,988 per intentional violation or violation involving a consumer the business knows is under 16. Each affected consumer can count as a separate violation, and there is no longer an automatic 30-day period to cure before enforcement. Consumers can sue directly only after a data breach caused by unreasonable security, for $107 to $799 each per incident or actual damages, whichever is greater.
Check your business
The CCPA/CPRA Business Applicability Checker runs the three tests. If you're a consumer, the CCPA Consumer Rights Request Generator drafts a request to know, delete or opt out.
Frequently Asked Questions
Does the CCPA apply to my small business?
Only if it meets one of three tests: gross annual revenue over $26,625,000 in the prior calendar year, buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or getting 50% or more of annual revenue from selling or sharing personal information. Most small businesses meet none of them.
What is the CCPA revenue threshold for 2026?
$26,625,000, in effect since January 1, 2025. It started at $25 million and is adjusted for inflation every odd-numbered year, so the next change is due January 1, 2027.
Does the CCPA apply to businesses outside California?
Yes. A for-profit business anywhere that does business in California, collects Californians' personal information and meets one of the three thresholds is covered.
What are the CCPA fines?
Up to $2,663 per violation, or $7,988 per intentional violation or violation involving a consumer the business knows is under 16, in administrative fines or civil penalties. In a data breach lawsuit, consumers can recover $107 to $799 each per incident, or actual damages if higher.
Do nonprofits have to comply with the CCPA?
Generally no. The CCPA applies to for-profit businesses; nonprofits and government agencies are generally not covered, although a nonprofit controlled by a covered business can be.
This article is for general information only and is not legal advice. Sources: Civil Code 1798.100 et seq. (CCPA as amended by the CPRA) and 1798.199.95; California Privacy Protection Agency, Updated Monetary Thresholds (effective January 1, 2025), FAQ, and September 23, 2025 announcement of the cybersecurity audit, risk assessment and ADMT regulations.