Skip to main content
WebSparkGet a site assessment

Does CCPA apply to my business?

Last reviewed
2026-09-16

If you do business in California and meet any one of three thresholds: annual gross revenue above a published figure, buying or selling or sharing the personal information of a stated number of California consumers a year, or deriving half or more of your revenue from selling or sharing personal information. Meeting one is enough.

The longer version

The revenue and consumer figures are set in the statute and adjusted over time, so the current numbers are the ones published by the California Privacy Protection Agency rather than the ones in an article from three years ago.

A business well under the revenue threshold can still be in scope through the second test, because sharing personal information for cross-context advertising counts. A site running advertising pixels may be sharing more than its owner realizes.

California is also not the only question. More than a dozen other states now have comprehensive privacy laws, and most of those have no revenue threshold at all, so a modest business with a lot of traffic can be in scope elsewhere while being out of scope in California.

What to do

  1. Check your revenue and your California consumer numbers against the current published thresholds.
  2. Establish whether you share personal information for advertising, which is the test people most often miss.
  3. Check the other states your customers are in, because the thresholds there are usually lower.
  4. If you are in scope anywhere, make sure your privacy notice is accurate and that there is a working route for requests.

The obligation behind this

Sources

  1. California Consumer Privacy Act (CCPA)California Office of the Attorney General
  2. California Privacy Protection AgencyCalifornia Privacy Protection Agency

WebSpark describes obligations and evidences what a site does. It does not provide legal advice, and this page is not a substitute for a lawyer who knows your business.