Does the CCPA Apply to My Business? The Three Thresholds
A for-profit business that does business in California and meets any one of three tests must comply. Your office location does not decide it; your California customers, employees and data do.
Employees and job applicants count as consumers too
Since January 1, 2023, the personal information of California employees, applicants, contractors and business contacts is covered.
How to tell whether the CCPA applies to you
The CCPA applies to a “business”: a for-profit entity that collects consumers’ personal information, decides why and how it is processed, does business in California and meets at least one threshold.
A “consumer” is any California resident: customers and website visitors, but also employees, job applicants, contractors and business contacts.
The revenue test looks at the preceding calendar year. The volume and revenue-share tests are annual, and the law does not say which 12 months count, so check both the last calendar year and the last 12 months. Write the decision down, with the numbers and the period you used, and have counsel approve it.
If you do business in California, any one of these tests generally brings you under the CCPA
in annual gross revenue in the preceding calendar year.
The statute says $25 million, adjusted for inflation. CalPrivacy set the current amount effective January 1, 2025, and adjusts it every odd-numbered year; the next update is due in January 2027.
California consumers or households whose personal information you buy, sell or share each year.
Sharing includes disclosure for cross-context behavioral advertising, such as advertising pixels on your website.
of annual revenue earned from selling or sharing consumers’ personal information.
Data brokers usually fall here and must also register with CalPrivacy under the Delete Act.
Affiliates can be covered too: an entity that controls or is controlled by a covered business, shares common branding with it and receives personal information from it.
A five-question applicability check
Are you a for-profit business that does business in California?
Out-of-state and online businesses can count if they sell to, serve or employ California residents; the law does not define “doing business in California”. The definition covers for-profit entities, so most nonprofits fall outside it; check affiliate and joint-venture situations with counsel.
Do you collect personal information about California residents?
Customers, website visitors, newsletter subscribers, employees, job applicants and business contacts all count. Personal information is broad: names, emails, IP addresses, device identifiers, purchase history and inferences.
Did you meet any of the three thresholds?
Use revenue for the preceding calendar year. For the volume and revenue-share tests, check the last calendar year and the last 12 months. Count consumers and households carefully, including advertising and analytics data.
Is some of your data exempt?
Certain data is exempt, but an exempt dataset does not make the business exempt. See the exemptions below.
Do the extra 2026 obligations apply?
Check the cybersecurity audit thresholds, the risk assessment triggers and whether you use automated decision-making for significant decisions.
Extra obligations by size and activity
| Who | Additional obligation | Rule |
|---|---|---|
| Every covered business | Notices, privacy policy, consumer requests, opt-outs if you sell or share, contracts, data minimization, reasonable security, records for 24 months | Civil Code §1798.100 and following; 11 CCR §7101 |
| Businesses handling the personal information of 10 million or more consumers a year | Compile request metrics and publish them by July 1 each year | 11 CCR §7102 |
| 50% or more of revenue from selling or sharing | Annual independent cybersecurity audit and certification to CalPrivacy | 11 CCR §7120(b)(1) |
| Over the revenue threshold and personal information of 250,000+ consumers or households, or sensitive personal information of 50,000+ consumers | Annual independent cybersecurity audit and certification to CalPrivacy | 11 CCR §7120(b)(2) |
| Selling or sharing, processing sensitive personal information, or other high-risk processing | Documented risk assessment before the processing starts | 11 CCR §7150 |
| Using automated decision-making for significant decisions | Pre-use notice, opt-out or appeal and access rights by January 1, 2027 | 11 CCR §7200 and following |
| Data brokers | Annual registration; access DROP and process deletion requests at least every 45 days since August 1, 2026, and every 30 days from January 1, 2027 | Delete Act; AB 883 |
Exempt data is not an exempt business
Health information
Protected health information governed by HIPAA and medical information governed by California’s CMIA are exempt. Website, marketing and employee data at a clinic usually are not.
Financial information under GLBA
Personal information collected under the federal Gramm-Leach-Bliley Act is exempt, but the data breach lawsuit provision still applies to it.
Consumer reports
Activity regulated by the federal Fair Credit Reporting Act, such as consumer reports, is largely exempt.
Deidentified and public data
Deidentified information, aggregate data and publicly available information fall outside the definition of personal information.
Three businesses, three answers
| Business (fictional, illustrative) | Facts | Likely result |
|---|---|---|
| 45-person engineering firm in Irvine | $14 million revenue, no data sales, website analytics configured as a service provider | Likely below all three thresholds. Still subject to California’s breach notice law and reasonable-security duty. |
| Southern California retailer | $40 million revenue, online store, loyalty program | Likely covered under the revenue test. Loyalty and advertising data would then need notices, opt-outs and a risk assessment if shared. |
| Out-of-state software company | $8 million revenue, advertising pixels on a site visited by 150,000 California users a year | Likely covered under the volume test, because advertising pixels can be sharing. |
Fictional companies for illustration. Your answer depends on your facts; confirm it with counsel.
Thresholds at a glance
annual gross revenue threshold in effect since January 1, 2025
Source: CalPrivacy monetary adjustmentconsumers or households whose data you buy, sell or share in a year
Source: Civil Code §1798.140(d)(1)(B)of revenue from selling or sharing personal information
Source: Civil Code §1798.140(d)(1)(C)consumers or households, or sensitive-data consumers, that trigger the audit for businesses over the revenue threshold
Source: 11 CCR §7120(b)If the CCPA applies, start here
Understand what consumers can ask for
Know, delete, correct, opt out and limit, with the deadlines your team must meet.
See whether you need a cybersecurity audit
The audit thresholds, the 2028 to 2030 deadlines and what the auditor must test.
Page 3 of 10: Does the CCPA apply to your business?
- 1. CCPA and CPRA compliance (hub)
- 2. CCPA vs CPRA explained
- 3. Does the CCPA apply to your business? (this page)
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit handles the technical side of the CCPA: data inventories, security controls and evidence as your readiness advisor, or the cybersecurity audit as your independent auditor, one role per program. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
We are not based in California. Does the CCPA still apply?
It can. The law looks at whether you do business in California and meet a threshold, not where your office is.
Does website analytics count as selling or sharing?
It depends on the tools and the contracts. Disclosing personal information to a third party for cross-context behavioral advertising is sharing, even without payment. Analytics run by a service provider under a compliant contract may not be. Review each tool with counsel.
Which year’s numbers count?
For revenue, the preceding calendar year. The volume and revenue-share tests are annual without a defined period, so check the last calendar year and the last 12 months. Re-check every January.
What if we fall below every threshold?
You are generally not a CCPA “business”, unless you are covered as an affiliate or joint venture of one. California’s data breach notification law and its general duty to maintain reasonable security for certain personal information still apply to businesses that own or license Californians’ personal information.
Do employees really count?
Yes. Since January 1, 2023, California employees, job applicants and contractors have the same CCPA rights as customers, subject to the law’s exceptions.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
- CalPrivacy: updated monetary thresholds in the CCPA (effective January 1, 2025)
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- CalPrivacy: data brokers and the DROP deletion platform
- California Legislature: AB 883, data broker deletion requests through DROP (approved September 27, 2026)
- California Attorney General: California Consumer Privacy Act (CCPA)
Get the facts your counsel needs, then a clear plan
Schedule a consultation. We help you gather the data counts and systems your counsel needs for the applicability decision, and show what comes next.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.