Does CCPA and CPRA apply to your business?

CCPA applies to for-profit businesses that do business in California and meet any one of three tests: over 25 million dollars in gross annual revenue, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half their revenue from selling or sharing it. CPRA amended the law and is not separate.

What is the difference between CCPA and CPRA?

The California Consumer Privacy Act of 2018 gave residents rights over the personal information businesses collect. In November 2020 voters approved Proposition 24, the California Privacy Rights Act, which amended the CCPA and added protections starting 1 January 2023. California's Attorney General notes that CPRA amends CCPA and does not create a new law, so the office usually calls it "CCPA, as amended." If a vendor sells you "CPRA compliance" as though it were a second regime, ask what they mean.

Who is covered?

The Attorney General's FAQ lists three tests for for-profit businesses that do business in California. Meeting any one is enough:

1. Gross annual revenue over 25 million dollars.
2. Buying, selling or sharing the personal information of 100,000 or more California residents or households.
3. Earning 50 percent or more of annual revenue from selling California residents' personal information.

The FAQ says the CCPA generally does not apply to nonprofits or government agencies. Only California residents have rights under it, and residents are people who live in California, even if they are temporarily elsewhere. Thresholds can be adjusted over time, so check the current text with counsel before relying on a number.

What rights do people have?

According to the Attorney General:

• The right to know what is collected, why, and with whom it is shared. Requests to know are free up to twice a year.
• The right to delete, with exceptions.
• The right to opt out of sale or sharing, including through a browser signal called global privacy control.
• The right to correct inaccurate information.
• The right to limit use and disclosure of sensitive personal information, such as Social Security numbers, account credentials and precise geolocation.
• The right not to be discriminated against for exercising rights.

Businesses must also give notices at or before collection, explaining what categories they collect and for what purposes.

What does a covered business have to build?

You need a working process, not a policy alone. At minimum:

• A data map, so you know what personal information you hold and where it flows.
• A way for people to submit requests, and a way to verify who they are.
• Handling for delete, correct, know and opt-out requests, across your systems and your service providers, who must also be told to delete.
• A privacy notice that matches what you really do.
• Support for the global privacy control signal where you sell or share data.

Where does security come in?

The law gives individuals a limited private right of action only after certain data breaches. The FAQ says you can sue if your nonencrypted and nonredacted personal information was stolen in a data breach resulting from a business's failure to maintain reasonable security procedures and practices, and describes statutory damages of up to 750 dollars per incident. For all other violations, only the Attorney General or the California Privacy Protection Agency can enforce. The text does not prescribe particular technical controls, so "reasonable security" is judged against recognized practice. Tools like Safeguard can help you find and fix technical weaknesses, but they do not make a business compliant with CCPA.

What to do

1. Check the three thresholds against your numbers, with counsel.
2. Build the data map: what you collect, where it is stored, who receives it.
3. Publish an accurate notice at collection and a full privacy policy.
4. Set up request intake, identity checks and a response process with tracking.
5. Review contracts with service providers so deletion and use limits flow down.
6. Honor opt-out signals if you sell or share personal information.
7. Review your security controls against a recognized baseline, and record the decisions.
8. Train the people who handle requests, and test the process with a mock request.

Quick check

Sources

• California Attorney General: California Consumer Privacy Act (CCPA)

Last reviewed: 18 October 2026.