What businesses does the CCPA apply to?

What the Law Says

The California Consumer Privacy Act (CCPA) defines which businesses are subject to its requirements based on specific quantitative and operational criteria.

The CCPA applies only to for-profit businesses that collect consumers’ personal information and determine the purposes and means of processing that information. It does not apply to nonprofits, government agencies, or entities outside the commercial context.

To be covered, a business must satisfy at least one of three thresholds: (1) have annual gross revenues exceeding $25 million; (2) annually buy, receive, sell, or share the personal information of 100,000 or more California consumers or households; or (3) derive 50 percent or more of its annual revenue from selling consumers’ personal information.

Importantly, the law applies regardless of whether the business has a physical presence in California — if it 'does business in California' (e.g., markets to, sells to, or collects data from California residents), it may be covered.

Statutory Text

a for-profit legal entity that collects consumers’ personal information, which determines the purposes and means of the processing of consumers’ personal information, that does business in California, and that satisfies one or more of the following thresholds: (A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000)… (B) Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, the personal information of 100,000 or more consumers or households… (C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information.

— Cal. Civ. Code § 1798.140(c)(1) — Definition of 'business'

Sources