The CCPA, the California Consumer Privacy Act, gives California residents the right to know, delete, correct and opt out of the sale or sharing of their personal information. It applies to for-profit businesses that do business in California and meet at least one threshold, such as gross annual revenue of $26.625 million or more.
Most small businesses aren't covered, and it's worth knowing that before you spend on a compliance tool. But two of the thresholds have nothing to do with size, and the law's old exemptions for employee and business contact data have gone, so it's worth five minutes to check where you stand.
Who the CCPA applies to
The California Privacy Protection Agency says the CCPA applies to for-profit businesses that collect consumers' personal information, do business in California and meet any one of these, as of October 2026:
| Threshold | What it means for a small business |
|---|---|
| Gross annual revenue of $26.625 million or more for the preceding calendar year (effective January 1, 2025) | Most owner-run businesses fall below this |
| Buy, sell or share the personal information of 100,000 or more California residents or households | Can apply to a busy website with ad tracking, whatever your revenue |
| Derive half or more of annual revenue from selling or sharing California residents' personal information | Catches data-led businesses of any size |
The Attorney General's page still quotes the original $25 million figure; the Agency's FAQ shows the adjusted $26.625 million effective January 1, 2025. The CCPA generally doesn't apply to nonprofits or government agencies. And you don't need an office in California: doing business there is the test.
The rights California residents have
- The right to know what personal information a business collects and how it's used and shared
- The right to delete personal information collected from them, with some exceptions
- The right to opt out of the sale or sharing of their personal information, including through a global privacy control
- The right to correct inaccurate personal information
- The right to limit the use and disclosure of sensitive personal information
- The right to non-discrimination for using these rights
Residents also have the right to be told, before or at the point of collection, what categories of personal information you collect and what you'll do with them. That's your notice at collection, and it's the piece most small sites forget.
The deadlines businesses must hit
| Request | Deadline from the Attorney General's guidance |
|---|---|
| Opt-out of sale or sharing | As soon as feasibly possible, and no later than 15 business days |
| Right to know | Up to 45 days, extendable by another 45 days (90 in total) if you tell the consumer |
| Methods to opt out | Businesses that sell or share must offer two or more methods |
If you sell or share personal information, you need a clear and conspicuous Do Not Sell or Share My Personal Information link on your site. For online businesses, the Attorney General says one acceptable method is a user-enabled global privacy control, the GPC browser signal, and businesses can't sell or share after an opt-out unless the person later authorises it.
Two exemptions that ended
Here's the catch for B2B companies. The Attorney General's FAQ says the exemptions for employment-related personal information and personal information from business-to-business transactions expired on December 31, 2022. The Agency confirms the law includes California residents who are employees or job applicants. So a covered company's HR records and sales prospect lists are in scope now.
Children and teens
Businesses can only sell the personal information of a child they know to be under 16 with opt-in authorisation. For children aged 13 to 15 the opt-in can come from the child; below that, the parent. If your audience is younger, the US federal rule for under 13s, COPPA, applies on top. Whatever your size, you still need a clear privacy notice; my guide on whether a small business website needs a privacy policy covers the basics.
New rules from 2026
The Agency says its regulations on automated decision-making technology (ADMT), privacy risk assessments and cybersecurity audits became effective January 1, 2026. If a business uses ADMT to make significant decisions about someone, such as decisions about employment, housing, financial services, education or healthcare, the person gets notice, an opt-out where applicable, and the right to meaningful information. Businesses must comply with the ADMT-specific requirements by January 1, 2027.
Penalties and lawsuits
Consumers can't sue for most CCPA violations. The Attorney General says they can sue only after a data breach of certain nonencrypted and nonredacted information caused by a failure to maintain reasonable security, for actual damages or statutory damages of up to $750 per incident as of October 2026. Everything else is enforced by the Attorney General or the California Privacy Protection Agency.
Canada, the UK and Australia have their own privacy laws with different triggers; if you market in Quebec, Quebec's Law 25 is the closest equivalent to check next.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
My verdict
If you're under $26.625 million and nowhere near 100,000 California visitors, the CCPA probably doesn't cover you yet, but its habits are good business anyway: a clear privacy notice, a working opt-out, and quick answers to data requests. If ad tracking puts you near the 100,000 mark, treat the CCPA as live and add the Do Not Sell or Share link before someone asks why it's missing.
Data from children has a federal rule of its own as well, and our COPPA guide explains it for small businesses.
Frequently asked questions
What is the CCPA?
The California Consumer Privacy Act is California's privacy law. It gives California residents rights over their personal information, including the right to know, delete, correct and opt out of its sale or sharing.
Does the CCPA apply to small businesses?
Only if they meet a threshold: gross annual revenue of $26.625 million or more (effective January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or getting half or more of revenue from selling or sharing it.
What is the difference between the CCPA and the CPRA?
The CPRA amended the CCPA. The Attorney General says the CPRA's amendments took effect on January 1, 2023 and businesses must comply with them.
Does the CCPA cover employee data?
Yes. The exemptions for employment-related and business-to-business personal information expired on December 31, 2022, according to the Attorney General.
How long does a business have to respond to an opt-out request?
As soon as feasibly possible, and no more than 15 business days from receiving it.
Can consumers sue under the CCPA?
Only after certain data breaches caused by a failure to maintain reasonable security. Other violations are enforced by the Attorney General or the California Privacy Protection Agency.
Do nonprofits have to comply with the CCPA?
The California Privacy Protection Agency says the CCPA generally doesn't apply to nonprofit organizations or government agencies.
