Who Does the CCPA Apply To?

The California Consumer Privacy Act (CCPA) generally applies to for-profit businesses that do business in California, collect or process California consumers’ personal information, determine how that information is used, and meet at least one of the applicable thresholds.

A business may be subject to the CCPA if it:

• Has annual gross revenue of $26.625 million or more for the preceding calendar year.

• Buys, sells, or shares the personal information of 100,000 or more California residents or households.

• Derives 50% or more of its annual revenue from selling or sharing consumers’ personal information.

The CCPA may also apply to certain entities controlled by covered businesses and qualifying joint ventures or partnerships. Service providers and contractors that process personal information for covered businesses may also have separate obligations under the CCPA.

Nonprofit organizations and government agencies are generally not subject to the CCPA, although specific exemptions and circumstances may affect whether the law applies to an organization or particular type of data.

Businesses should assess these thresholds before determining which CCPA requirements apply to their data practices.