Who Is Subject to the CCPA? Thresholds, Exemptions, and Penalties

A for-profit business is subject to the California Consumer Privacy Act if it collects personal information from California residents, does business in the state, and meets at least one of three size-based tests: more than $25 million in annual gross revenue, handling the personal information of 100,000 or more California consumers or households each year, or earning 50 percent or more of its annual revenue from selling or sharing personal information. Only one of the three has to be true. The law also reaches corporate affiliates that share branding with a covered business, certain joint ventures, and any service provider or contractor hired to process the data.

The Three Thresholds That Pull a Business In

The CCPA defines a covered “business” as a for-profit entity that does business in California, collects consumers’ personal information, and satisfies any one of these criteria:

Had annual gross revenue above $25 million as of January 1 of the calendar year. This figure is based on total worldwide revenue, not just California sales.
Annually buys, sells, or shares the personal information of 100,000 or more California consumers or households. Digital identifiers such as IP addresses and browsing history count toward this total, so a high-traffic website can cross the line without ever running a traditional data sale.
Earns 50 percent or more of annual revenue from selling or sharing consumers’ personal information. This test is aimed at data brokers and marketing firms whose core business is personal data.

Meeting any single threshold brings the entire organization under the law.¹ Because the 100,000-consumer threshold sweeps in automated tracking data, auditing the cookies and trackers on your website is often the fastest way to tell whether you are approaching it.

Affiliates, Subsidiaries, and Joint Ventures

A corporate parent cannot sidestep the CCPA by splitting operations into smaller entities. The law extends to any entity that controls — or is controlled by — a covered business, so long as the two share common branding. Control means owning more than 50 percent of the outstanding voting shares, controlling a majority of the board, or holding the power to direct management. Shared branding means a common name, service mark, or trademark that consumers would reasonably associate with the parent.¹ A subsidiary that would fall below every threshold on its own still has to comply if it operates under the same brand as a covered parent.

Joint ventures get their own rule. When two or more businesses form a joint venture in which each partner holds at least a 40 percent interest, the joint venture is treated as a separate business under the CCPA. Personal information one partner discloses to the joint venture cannot be shared with the other partner businesses without following the law’s requirements.¹

Businesses Outside California and the Meaning of “Consumer”

You do not need a physical office or employees in California to be covered. The statute reaches any for-profit entity doing business in the state, and providing digital services to California residents, shipping products to them, or otherwise directing commercial activity at the California market is generally enough to establish that connection.

The people the law protects are called “consumers,” but the term is broader than its everyday meaning. A consumer is any natural person who is a California resident — meaning someone in the state for other than a temporary or transitory purpose. That includes employees, job applicants, and independent contractors who live in California.² Because the rights follow the person rather than the business, out-of-state companies still have to honor them for California-resident customers, workers, and contacts.

Service Providers and Contractors

Vendors that process personal information on behalf of a covered business have their own exposure, but they get there a different way. Service providers and contractors become subject to the CCPA through their contractual relationship with the covered business, not through the revenue or data-volume thresholds. A written contract must be in place that prohibits the vendor from selling or sharing the personal information it receives, and from using or keeping that information for any purpose beyond performing the contracted services.³ When a vendor hires its own sub-processors, it must notify the business and pass the same restrictions down the chain.

The covered business bears ultimate responsibility for its vendors’ compliance. Failing to include the required contractual restrictions can expose the primary business to liability for a vendor’s data-handling failures.

Who Is Not Subject to the CCPA

Nonprofits generally fall outside the law, because the statutory definition of “business” is limited to entities organized or operated for the profit or financial benefit of their shareholders or owners. State and local government agencies are also outside the CCPA’s scope.² Any entity, including a nonprofit, may voluntarily certify that it complies.⁴

Even for covered businesses, certain data is handled by other laws. Medical information under HIPAA, financial data under the Gramm-Leach-Bliley Act, and consumer credit data under the Fair Credit Reporting Act are generally excluded from the CCPA’s requirements.⁴ A hospital or bank can still be a covered business; the specific records it handles under those federal regimes are governed by them instead. Information lawfully made available to the general public is also outside the definition of “personal information,” though combining public data with other personal information can cause the combined dataset to lose that exemption.⁵

What Being Subject to the Law Requires

A covered business must give consumers a notice at or before the point personal information is collected, identifying the categories of information gathered, the purposes for each category, whether the information will be sold or shared, and the consumer’s rights to opt out or to limit the use of sensitive personal information. Collecting new categories, or using information for purposes incompatible with the original stated purpose, requires a fresh notice.⁶ Covered businesses must also honor consumer requests to know, delete, correct, and opt out of the sale or sharing of personal information, including through browser-based tools such as Global Privacy Control.²

Penalties for Non-Compliance

The California Privacy Protection Agency enforces the law and can bring administrative actions against any business, service provider, contractor, or other person that violates it. Fines run up to $2,500 per violation, or up to $7,500 per violation if the violation is intentional or involves a consumer the business knows is under 16.⁷ Because penalties are assessed per violation, meaning per affected consumer, they add up quickly for businesses that handle large volumes of data.

Consumers also have a narrow private right of action. If a business fails to maintain reasonable security practices and a breach exposes a consumer’s unencrypted and unredacted personal information, the affected consumer can sue for statutory damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater.⁸ The original 30-day cure period ended on January 1, 2023, so any opportunity to fix a violation before penalties attach is now entirely at the discretion of the agency or the Attorney General.

1
California Legislative Information. California Civil Code 1798.140 – Definitions
2
State of California Department of Justice. California Consumer Privacy Act (CCPA)
3
Cornell Law School. Cal Code Regs Tit 11, 7051 – Contract Requirements for Service Providers and Contractors
4
California Privacy Protection Agency. Does My Business Need To Comply With The CCPA
5
California Privacy Protection Agency. Frequently Asked Questions (FAQs)
6
California Legislative Information. California Civil Code 1798.100
7
California Legislative Information. California Civil Code 1798.155 – Administrative Enforcement
8
California Legislative Information. California Civil Code 1798.150 – Personal Information Security Breaches