The CCPA applies to a for-profit business that does business in California and meets any one of three thresholds: annual gross revenue above $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50 percent or more of revenue from selling their information.
The thresholds, as the California Attorney General states them
- Annual gross revenue above $25 million.
- Buys, sells or shares the personal information of 100,000 or more California residents or households.
- Derives 50 percent or more of annual revenue from selling California residents' personal information.
The Attorney General's page says nonprofits and government agencies generally are not covered. The dollar figure is stated there as $25 million. Thresholds in California law can be adjusted over time, so check the current text of the statute and the CPPA before relying on a number.
Reading "does business in California"
You do not need an office there. Selling to Californians online can be enough to raise the question. The statute and regulations decide what "doing business" means, so have counsel apply them to your model.
Households and devices
The second threshold counts residents or households. A consumer product with many devices and logged out visitors can reach 100,000 faster than a typical B2B tool. Count how you collect, not just accounts.
What changes if you are covered
According to the Attorney General, consumers have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and not face discrimination. You also need:
- A notice at collection listing the categories of personal information and the purposes.
- A privacy policy that explains the rights and how to use them.
- A "Do Not Sell or Share My Personal Information" link if you sell or share.
- Response times: 45 calendar days for requests to know, delete and correct, with one 45 day extension if you notify the person, and up to 15 business days for opt outs.
The opt out and Global Privacy Control post covers the signal side in more detail.
A scoping worksheet
- Revenue last year, worldwide gross.
- Count of California residents or households whose data you buy, sell or share.
- Share of revenue from selling personal information.
- Whether you act as a service provider for a covered business, which brings contract duties even if you are not covered yourself.
The last item is practical advice, not text from the page above. Customers who are covered will push terms down to you.
Quick check
We are a small startup under $25 million. Are we safe?
Not automatically. The other two thresholds count people and data sales, not revenue.
Are B2B contacts included?
The Attorney General page speaks of California residents. Ask counsel how the statute treats business contact data in your case.
Sources
Last reviewed: 19 October 2026.
