CCPA Definitions: Key Terms, Exclusions, and Penalties

The California Consumer Privacy Act builds its rules on a set of defined terms in Civil Code Section 1798.140, and the CCPA definitions decide almost everything that follows: who the law protects, which companies have to comply, what data is covered, and when a data transfer gives you the right to opt out. The terms below reflect the statute as amended by the California Privacy Rights Act, with the inflation-adjusted thresholds in effect for 2025.¹

Consumer

A consumer is a natural person who lives in California on more than a temporary basis. Someone domiciled in the state but traveling briefly still qualifies. Tourists, business visitors passing through, and anyone whose presence is transitory do not.¹

Residency is the dividing line. The law does not require citizenship or any particular immigration status. If you maintain a home in California and treat it as your permanent base, the CCPA’s rights apply to you regardless of where you happen to be on a given day.

Personal Information

Personal information covers any data that identifies, relates to, or could reasonably be linked to a specific person or household. That reaches obvious identifiers like your name and Social Security number, and it also reaches IP addresses, browsing history, purchase records, geolocation data, and biometric information. Employment history and professional information count too, as long as they can be traced back to an individual.¹

The threshold is whether the data is “reasonably linkable” to a person, directly or indirectly. A company cannot dodge the law by calling its records anonymous when combining a few data points would reveal someone’s identity.

Inferences

One category catches people off guard: inferences. Profiles a company builds about you by analyzing your data are themselves personal information. If a business combines your browsing habits, purchases, and location to draw conclusions about your preferences, attitudes, or behavior, those conclusions carry the same rights as any direct identifier.²

Sensitive Personal Information

The CPRA added a higher-protection tier called sensitive personal information. It covers data that carries greater risk of harm if exposed:¹

Government identifiers: Social Security, driver’s license, state ID, and passport numbers
Financial account credentials, including card numbers combined with any required security code or password
Precise geolocation, meaning your exact location rather than a city or region
Contents of your mail, email, and text messages, unless the business was the intended recipient
Genetic and neural data, including information generated by measuring nervous system activity
Biometric data processed to uniquely identify you
Health information collected and analyzed about you
Sex life or sexual orientation data
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership

The classification matters because you have a separate right to limit how a business uses sensitive personal information. You can direct a company to use that data only for the purposes necessary to deliver the service you requested, blocking secondary uses like profiling or advertising.³

Business

The CCPA applies to for-profit entities that collect California consumers’ personal information and meet at least one of three size thresholds:¹

Annual gross revenues in the preceding calendar year above $25 million, a figure adjusted annually for inflation. The 2025 adjusted figure is $26,625,000.⁴
Buying, selling, or sharing the personal information of 100,000 or more consumers or households each year
Deriving 50 percent or more of annual revenue from selling or sharing consumer personal information

Meeting a single test is enough. The revenue threshold is the one most companies watch, and the annual inflation adjustment lifts it each year.

Common Branding and Control

The definition also pulls in related entities. If one company controls another and they share a name, service mark, or trademark that an average consumer would recognize as common ownership, the controlled entity is treated as a “business” too. Control means owning more than 50 percent of voting shares, directing a majority of the board, or exercising a controlling influence over management.¹ A large company cannot spin consumer data into a subsidiary and claim the subsidiary is too small to comply.

Service Providers, Contractors, and Third Parties

The statute sorts entities that handle personal information into three categories, and the category changes the obligations.

Service Providers

A service provider processes personal information on behalf of a business under a written contract. The contract must bar the service provider from selling or sharing the data, using it for any purpose beyond what the contract specifies, or combining it with information from other sources. The defining feature is that the data flows from the business to the service provider so the provider can perform a specific function, such as payment processing or cloud storage.¹

Contractors

A contractor is a person or entity to whom a business makes personal information available for a business purpose, also under a written contract. The contractual restrictions mirror those for service providers. Two additional requirements set contractors apart:¹

The contractor must certify in writing that it understands the restrictions and will follow them.
The contract must let the business monitor compliance through manual reviews, automated scans, or audits at least once every 12 months.

If a contractor subcontracts any data processing, it must notify the original business, and the subcontractor must be bound by the same written restrictions.

Third Parties

A third party is defined by exclusion: anyone who is not the business the consumer interacted with, not a service provider to that business, and not a contractor to that business. When data moves to a third party, the transfer is far more likely to count as a “sale” or “share” that triggers opt-out rights. This is the category advertisers, data brokers, and analytics companies most often fall into.¹

Sale and Sharing

Selling and sharing are separate concepts under the CCPA, and each creates its own opt-out right.

Sale

A sale is any transfer of personal information to another party for valuable consideration. Cash is not required. If a business hands over consumer data in exchange for a service, analytics access, or any other benefit, that counts. The definition is deliberately broad to stop companies from structuring around it with creative barter.¹

Sharing

Sharing is narrower: transferring personal information to a third party specifically for cross-context behavioral advertising. That means targeting ads based on your activity across multiple unrelated sites or apps. A company that passes your browsing data to an ad network so the network can follow you around the internet is sharing your information, even if no money changes hands.¹

You can opt out of sales and sharing independently. A business must honor a request to stop sharing for behavioral advertising even if you have not opted out of sales, and the reverse holds too.

Verifiable Consumer Request

When you exercise CCPA rights, the business needs a way to confirm the request is legitimate. A verifiable consumer request is one the business can reasonably confirm came from the actual consumer, or from someone the consumer authorized. The authorized agent can be a natural person or a business registered with the Secretary of State.

Verification scales with the sensitivity of the request. Asking what categories of data a business holds about you requires a lower level of certainty than asking for the specific pieces or demanding deletion. For specific-data or deletion requests, the business may need to match multiple data points and require a signed statement under penalty of perjury. Opt-out requests do not require verification at all. A business cannot force you through identity-confirmation hoops just to stop the sale or sharing of your information.

Dark Patterns

A dark pattern is a user interface designed or manipulated in a way that substantially undermines your ability to make a genuine choice. Burying the opt-out behind confusing menus, using misleading language to steer you toward agreement, or making “yes” easy and “no” frustrating all qualify.¹

The legal consequence is significant: any consent obtained through a dark pattern is not valid. If a business uses manipulative design to get you to agree to the sale of your data, that agreement does not count, and the business is treated as if it never obtained consent.

What the CCPA Excludes From Personal Information

Not every piece of data about a person triggers CCPA obligations. The statute carves out three categories.

Publicly Available Information

Information lawfully obtained from federal, state, or local government records is not personal information under the CCPA. The same goes for information you have made available to the general public or shared without restricting the audience. Biometric information a business collects without your knowledge never qualifies as publicly available, even if related material is accessible elsewhere.¹

De-Identified Data

De-identified data is information stripped of identifying details so it cannot reasonably be used to figure out whom it belongs to. Removing names is not enough. The law imposes a three-part test:¹

The business takes reasonable measures to ensure the data cannot be linked back to any consumer or household.
The business publicly commits to keeping the data in de-identified form and not attempting to re-identify it, except to test whether its de-identification process works.
Anyone who receives the data is contractually required to follow the same rules.

All three prongs must be satisfied. A company that strips names but does not contractually bind its data recipients has not de-identified anything under this law.

Aggregate Consumer Information

Aggregate data summarizes information about a group of consumers in a way that removes individual identities and is not reasonably linkable to any specific person or household. A report stating that 60 percent of customers in a region prefer a particular product is aggregate data. Individual de-identified records do not become aggregate data by being grouped together; true aggregation requires that no single consumer can be picked out of the set.¹

Why the Definitions Drive Penalties

Enforcement reads directly off these terms. The California Privacy Protection Agency holds primary enforcement authority, and the Attorney General can also bring civil actions. The base penalties in the statute are up to $2,500 per violation and up to $7,500 for each intentional violation or each violation involving the data of a minor the business knew was under 16.⁵ As of 2025 those adjusted amounts are $2,663 and $7,988.⁴ Because penalties run per violation, a single data practice affecting thousands of consumers can produce enormous aggregate liability, and whether a given practice is a “violation” depends on whether the entity is a business, the data is personal information, and the transfer is a sale or share.

1
California Legislative Information. California Code CIV 1798.140 – Definitions
2
California Privacy Protection Agency. California Consumer Privacy Act of 2018
3
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
4
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
5
California Legislative Information. California Code CIV 1798.199.90