Test the current CCPA in sequence: California nexus, definition, Consumer Price Index (CPI)-adjusted or volume/revenue threshold, controlled-business routes, exemptions, data and recipient roles, then the obligations triggered by each processing activity.
The CPRA amended the CCPA; it is not a separate replacement regime. Employee and -to-business data are no longer covered by the former temporary exemptions, while sector and data-specific exemptions remain fact dependent.
Apply this test separately to each legal entity. California users alone do not make an entity a CCPA : the entity must fit the main business definition, a related-entity or joint-venture route, or voluntary certification. If it is covered, repeat the role analysis for each data flow because one organization can be a business for one activity and a service provider or contractor for another.
The main route covers a legal entity organized or operated for profit or financial benefit that collects consumers' personal information or has it collected on its behalf, does in California, determines the purposes and means of processing consumers' personal information, and meets at least one threshold. Effective January 1, 2025, the inflation-adjusted annual gross revenue threshold is more than $26,625,000 for the preceding calendar year.
The other thresholds are buying, selling, or sharing personal information of 100,000 or more consumers or households in a year, alone or in combination; or deriving 50 percent or more of annual revenue from selling or sharing consumers' personal information. Record the measurement period, counting and deduplication method, and disclosures treated as sales or sharing.
Sources (3)
Civil Code section 1798.140 defines a business and states the threshold and related-entity routes.
Current consolidated regulations used after scope is established to assign disclosures, request handling, contracts, assessments, audits, and ADMT duties.
Official notice setting the business gross-revenue threshold at $26,625,000 effective January 1, 2025.
Coverage does not settle role. A determines why and how personal information is processed. A service provider or contractor processes personal information for a business under a qualifying written contract and statutory restrictions. A recipient outside those conditions may be a third party, and the disclosure may be a sale or sharing.
Classify recipients from actual processing and contract terms. A service-provider label does not excuse independent advertising, product development, or another use outside the limited purpose.
Sources (2)
Articles 3 and 4 govern request operations and contracts for service providers, contractors, and third parties.
Binding definitions of business, service provider, contractor, third party, sale, and sharing. The separate data-broker definition is in Civil Code section 1798.99.80.
The decision should state whether the entity is covered, the coverage route, the information and processing excluded under specific provisions, and the role of each material recipient. It should then assign the resulting disclosures, rights, opt-outs, contracts, retention, security, risk-assessment, audit, and automated decisionmaking technology (ADMT) work.
Reassess at least annually before relying on the preceding calendar year's revenue and the current annual volume tests. Reopen the decision sooner when revenue, volume, ownership, branding, intercompany sharing, product purpose, vendor use, or California activity changes.
Sources (2)
Current consolidated regulations for the duties assigned after the scope and role analysis.
Official status page for regulations effective January 1, 2026 and phased compliance dates.
Record the coverage route, threshold evidence, exemptions, processing roles, assigned duties, and reassessment triggers for each legal entity.
Turn Applicability Test into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.