For a startup, the first 90 days with the California Consumer Privacy Act (CCPA, as amended by the CPRA) are about three jobs: decide whether the law applies to you, find out what personal information you hold and share, and set up a working way to answer consumer requests. This is general information, not legal advice.
Does the CCPA apply to us?
The California Attorney General's CCPA page says the law applies to for-profit businesses that do business in California and meet any of these: a gross annual revenue above a stated threshold, buying, selling or sharing personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling or sharing California residents' personal information. The dollar threshold is adjusted over time, and the California Privacy Protection Agency, which calls itself CalPrivacy, keeps a page of current monetary thresholds. Check that page rather than relying on a number in an article.
The same page states that the exemptions for employee and business to business personal information expired on 31 December 2022, which matters if you hold HR or customer contact data. Nonprofits and government agencies are generally outside the law.
Which rights must we be able to honor?
The Attorney General lists the right to know what personal information is collected, used, shared or sold, the right to delete (with exceptions), the right to opt out of sale or sharing, including through Global Privacy Control signals, and further rights covered on the same page. An authorized agent can submit requests on a consumer's behalf. The regulations, effective 1 January 2026 according to CalPrivacy, give the detailed requirements, and CalPrivacy lists completed rulemaking on cybersecurity audits, risk assessments and automated decisionmaking technology.
Days 1 to 30: scope and map
Decide applicability with counsel. Build a data inventory: what you collect, from whom, why, where it is stored, which vendors receive it, and how long you keep it. Include analytics tags, advertising pixels and support tools, since "sharing" can happen through those. Name an owner for privacy.
Days 31 to 60: notices and requests
Rewrite your privacy notice from the inventory, not from a template. Create an intake route for requests, with identity verification steps and a log. Test it with a dummy request and time the answer. Turn on honoring of opt out preference signals where sale or sharing exists.
Days 61 to 90: vendors and security
Review contracts with vendors that receive personal information and make sure the terms limit their use of it. Document your security measures in plain language, since the regulations now address cybersecurity audits and you should know where you stand. Run a short training for staff who handle requests or customer data. Schedule a review date.
What to do
- Check current thresholds on CalPrivacy's site and record the decision and the date.
- Build and date the data inventory.
- Map every vendor that receives personal information.
- Publish an accurate notice and a way to submit requests.
- Test request handling end to end and keep the log.
- Honor opt out preference signals if you sell or share.
- Put security basics in writing: access control, encryption, logging, incident response.
- Calendar a 90 day review with counsel.
Quick check
Is the CCPA only for big companies?
No. Revenue is one of three tests. A startup with a large consumer user base in California can meet the 100,000 residents or households test.
Do I need a security certification for the CCPA?
The law does not require a specific certification. It expects reasonable security and its regulations address cybersecurity audits and risk assessments. Ask counsel what applies to you.
Sources
- California Attorney General, California Consumer Privacy Act
- California Privacy Protection Agency, Laws and Regulations
Last reviewed: 18 October 2026.
