US CCPA Thresholds

The primary definition covers a for-profit legal entity that collects consumers' personal information, or has it collected on its behalf; alone or jointly determines the purposes and means of processing; does business in California; and meets at least one threshold. Nonprofits and government agencies generally fall outside this definition, but labels and tax status do not replace analysis of the entity and its role.

The three tests are: gross annual revenue in excess of $26,625,000 for the preceding calendar year, effective January 1, 2025; annually buying, selling, or sharing the personal information of at least 100,000 consumers or households, alone or in combination; or deriving at least 50 percent of annual revenue from selling or sharing consumers' personal information. For the volume test, count distinct consumers or households covered by the statutory activity, not database rows, devices, events, or transactions. The CPPA adjusts the monetary threshold on January 1 of each odd-numbered year, so confirm the official amount before using it for 2027 or a later year.

Coverage can also reach an entity that controls or is controlled by a threshold business, shares common branding with it, and shares consumers' personal information with it. A joint venture or partnership composed of businesses in which each has at least a 40 percent interest is separately treated as a business. A person doing business in California may also voluntarily certify to the CPPA that it will comply and be bound.

For the controlled-entity route, control means more than 50 percent of voting securities, control over election of a majority of directors or equivalent functions, or power to exercise a controlling influence over management. Common branding means a shared name, service mark, or trademark that an average consumer would understand as common ownership. All three route-specific facts, including intercompany sharing of consumers' personal information, need evidence.

After finding coverage, test statutory exemptions and data-specific carve-outs separately. Also classify recipients as service providers, contractors, or third parties. Those roles carry obligations even though they are not established by the three primary business thresholds. Reassess at least annually, using the preceding calendar year for the gross-revenue threshold, and sooner after acquisitions, divestitures, major growth, new data brokerage or advertising activity, or changed affiliate data flows.

Keep a dated applicability memo for each legal entity. It should show the preceding-year gross revenue, the method used to count consumers and households whose information was bought, sold, or shared, and the calculation of revenue derived from sale or sharing. Reconcile the figures to finance records, data maps, contracts, and advertising or data-transfer systems.

Document the nonnumeric tests as carefully as the thresholds: California business activity, profit status, purposes-and-means decision authority, ownership and control, common branding, intercompany sharing, joint-venture interests, voluntary certification, and service-provider or contractor roles. Record any exemption by the covered data and processing, not as a blanket conclusion unless the law supports an entity-wide exclusion.

Do not stop after one failed threshold. The tests are alternatives, and the controlled-entity, joint-venture, and voluntary routes are separate. Recalculate after acquisitions, divestitures, changes in intercompany data sharing, new advertising practices, or material growth.

Do not count every record as a separate consumer, omit households, or limit the volume test to information sold. The statute includes personal information bought, sold, or shared. Likewise, revenue from sharing counts in the 50-percent test.