Who Is Subject to the CCPA? Thresholds and Exemptions

The California Consumer Privacy Act applies to any for-profit business that does business in California and meets at least one of three size tests: annual gross revenue above $26,625,000, buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year, or earning 50% or more of annual revenue from selling or sharing personal information.¹² Hitting any one of the three is enough. A company can also be pulled in through its corporate affiliations even if it doesn’t independently qualify.

The For-Profit and “Doing Business” Requirement

Before the thresholds matter at all, two preliminary conditions have to be met. The entity must be for-profit, and it must be doing business in California.

Non-profit organizations and government agencies sit outside the CCPA’s definition of a business entirely.² Corporate form among for-profits doesn’t matter: LLCs, partnerships, sole proprietorships, and traditional corporations all qualify on equal terms.

“Doing business in California” is not spelled out with a detailed physical-presence test in the statute. A physical office in the state is not required. In practice, actively marketing to California residents, collecting their personal information through a website, or otherwise participating in the state’s economy is enough of a commercial connection to put a company inside the law’s reach, assuming it also crosses one of the thresholds below.²

The Three Thresholds in Detail

A for-profit business doing business in California falls under the CCPA if it meets any one of the following tests. Each has a quirk worth knowing.

Annual Gross Revenue Above $26,625,000

This is the CPI-adjusted figure effective January 1, 2025. Because the California Privacy Protection Agency adjusts the thresholds only in odd-numbered years, the next change is scheduled for 2027, and this number stays in effect through 2026.¹

The quirk: the figure covers total global revenue, not just revenue earned from California customers. A company with modest California sales but large revenue elsewhere can trip this threshold without ever intending to be a “California business” in the colloquial sense.

Data on 100,000 or More California Consumers or Households Per Year

The California Privacy Rights Act, which amended the CCPA effective January 1, 2023, raised this number from the original 50,000 to 100,000.² The count covers personal information that the business buys, sells, or shares in a year. For companies with a substantial California web audience, this threshold can be crossed quickly — IP addresses and online identifiers count as personal information under the law.

50% or More of Revenue From Selling or Sharing Personal Information

This test catches data brokers and ad-tech companies that might not hit the revenue or data-volume thresholds on their own but whose business model is built around personal information.² A small firm earning $5 million per year is just as covered as a multinational if more than half of that revenue comes from selling or sharing consumer data.

Businesses that fall below all three thresholds are not required to comply, but may voluntarily certify their compliance through a mechanism the California Privacy Protection Agency is required to establish.

Affiliates and Shared Branding

The CCPA closes the obvious workaround of splitting a large operation into smaller units. If a parent company meets any of the three thresholds, its subsidiaries and affiliates can be pulled in too. Coverage extends to any entity that controls or is controlled by a covered business and shares common branding with it.³

“Control” under the statute is broader than simple majority ownership. It includes owning or having the power to vote more than 50% of a business’s voting shares, controlling the election of a majority of its directors, or exercising a controlling influence over its management. “Common branding” means a shared name, service mark, or trademark that a reasonable consumer would associate with common ownership.³

The practical test: if your brand name is on it and a related entity qualifies, your company is likely covered regardless of its own revenue or data volume.

Service Providers and Contractors

Companies that process personal information on behalf of a covered business occupy a different role under the CCPA. They are not themselves measured against the three thresholds in the same way, but they are bound to the law through required contract terms.

A written contract with the covered business is mandatory. That contract must prohibit the service provider or contractor from retaining, using, or disclosing the information for any purpose beyond what the agreement specifies, and it must prevent the processor from combining personal information received from different businesses or other sources. Contractors face an additional requirement: they must certify in writing that they understand and will comply with these restrictions.³

This matters most when things go wrong. If a covered business shares consumer data with a vendor without the required contractual protections, the business itself faces enforcement risk. Auditing vendor contracts for CCPA-compliant language is one of the compliance steps that companies most frequently skip.

Employee and B2B Contact Data Are Now In Scope

A common misconception is that the CCPA only touches consumer-facing data. The original law included temporary exemptions for employment-related personal information (data about employees, job applicants, and independent contractors) and for personal information collected during business-to-business transactions. Both exemptions expired on December 31, 2022.²

Since January 1, 2023, covered businesses must treat employee and B2B contact data the same as consumer data. If your company qualifies under one of the thresholds based on customer data, your HR records and your sales-contact database are inside the law’s scope too.²

Who and What Is Not Subject

Several categories sit outside the law even when the thresholds are met, or exclude a business from being covered at all.

On the organizational side: non-profit organizations and government agencies are not covered. For-profit businesses that remain below all three thresholds and that are not pulled in through affiliate rules are also outside the law’s reach.²

On the data side, even an otherwise-covered business gets carve-outs for specific categories regulated under federal law. Medical information already governed by HIPAA is exempt. Financial data regulated under the Gramm-Leach-Bliley Act is exempt. Consumer credit reporting information subject to the Fair Credit Reporting Act gets its own carve-out.²

These exemptions attach to the data, not the entity. A hospital covered by HIPAA still has CCPA obligations for personal information it collects that falls outside HIPAA’s scope, such as data gathered through its marketing website or a gift shop loyalty program. The same logic applies to banks and credit reporting agencies: the federally regulated data is carved out, but other personal information the business handles is not.

If your company clears the for-profit and California-nexus requirements and crosses any one of the three thresholds — or is affiliated with and shares branding with a company that does — you are a covered business. From there, the obligations around notices, consumer rights, response timelines, and vendor contracts follow.

1
California Privacy Protection Agency (CPPA). Updated Monetary Thresholds in CCPA
2
State of California Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
3
California Privacy Protection Agency. California Consumer Privacy Act of 2018