US CCPA Applicability Test

The main route covers a legal entity organized or operated for profit or financial benefit that does business in California, determines the purposes and means of processing consumers' personal information, and meets at least one threshold. Effective January 1, 2025, the inflation-adjusted annual gross revenue threshold is more than $26,625,000 for the preceding calendar year.

The other thresholds are buying, selling, or sharing personal information of 100,000 or more consumers or households in a year, alone or in combination; or deriving 50 percent or more of annual revenue from selling or sharing consumers' personal information. Record the measurement period, counting and deduplication method, and disclosures treated as sales or sharing.

An entity that misses the main thresholds can still be covered if it controls or is controlled by a covered business, shares common branding with that business, and shares consumers' personal information with it. Also check qualifying joint ventures or partnerships and voluntary certification to the CPPA.

Most exemptions attach to information or processing, not the whole organization. Map the exact conditions for CMIA medical information, HIPAA protected health information, GLBA information, FCRA activity, and information processed wholly outside California. The former general employee and business-to-business exemptions expired at the end of 2022.

Coverage does not settle role. A business determines why and how personal information is processed. A service provider or contractor processes personal information for a business under a qualifying written contract and statutory restrictions. A recipient outside those conditions may be a third party, and the disclosure may be a sale or sharing.

Classify recipients from actual processing and contract terms. A service-provider label does not excuse independent advertising, product development, or another use outside the limited business purpose.

The decision should state whether the entity is covered, the coverage route, the information and processing excluded under specific provisions, and the role of each material recipient. It should then assign the resulting disclosures, rights, opt-outs, contracts, retention, security, risk-assessment, audit, and ADMT work.

Reassess at least annually before relying on the preceding calendar year's revenue and the current annual volume tests. Reopen the decision sooner when revenue, volume, ownership, branding, intercompany sharing, product purpose, vendor use, or California activity changes.