CCPA business thresholds
does the CCPA apply to my business / CCPA $25 million threshold / CCPA revenue threshold
The CCPA business thresholds are the three tests that decide whether California's privacy law covers a for-profit company doing business in the state. Meeting any one is enough: revenue above $26,625,000 a year, buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half its revenue from selling or sharing it.
The Attorney General's CCPA page lists the tests for a for-profit business that does business in California. The first is gross annual revenue of over $25 million. The second is buying, selling or sharing the personal information of 100,000 or more California residents or households. The third is deriving 50% or more of annual revenue from selling their personal information. The agency's own FAQ words that test as selling or sharing, and measures revenue over the preceding calendar year.
The revenue figure on that page is the amount in force before 2025. The law adjusts its monetary thresholds for inflation every odd-numbered year. The California Privacy Protection Agency set the revenue amount at $26,625,000 from January 1, 2025, so on that schedule the next change falls in 2027.
The same adjustment raised the fines. Administrative fines now run to not more than $2,663 for each violation, or $7,988 for each intentional violation. The Attorney General's page adds that the CCPA generally does not apply to nonprofit organizations or government agencies.
In practice
A home services company with $18 million in annual revenue does business in California. It is under the revenue test, so whether the law applies turns on the other two. One is how many consumers' or households' personal information it buys, sells or shares. The other is how much of its revenue comes from selling or sharing personal information. The figures are a worked example.
Why it matters to you
A business that decides it is too small on revenue alone has only answered one of three tests. And a decision made from a page that still says $25 million rests on an outdated figure. Check the current amount on the agency's page before concluding the law does not apply.
What to ask or check
- 01Which revenue figure was used to decide whether the CCPA applies, and is it the current one?
- 02About how many California consumers or households does the business buy, sell or share personal information about each year?
- 03Does any of the business's revenue come from selling or sharing personal information?
What people get wrong
That the revenue threshold is $25 million. That was the amount before January 1, 2025. The California Privacy Protection Agency's current figure is $26,625,000.