US CCPA Thresholds

Start with Civil Code section 1798.140(d), then apply the current CPI adjustment. As of January 1 of the calendar year, the revenue route asks whether the entity's annual gross revenue in the preceding calendar year exceeded $26,625,000, the CPPA-adjusted amount effective January 1, 2025. The other routes ask whether the entity annually buys, sells, or shares the personal information of 100,000 or more consumers or households, or derives 50 percent or more of annual revenue from selling or sharing consumers' personal information. One route is enough.

The threshold routes sit inside a broader entity test. The entity must be organized or operated for profit, do business in California, collect consumers' personal information or have it collected on its behalf, and determine the purposes and means of processing alone or jointly. A threshold result does not by itself resolve statutory exemptions, the treatment of a particular data set, a recipient's role, or which activity-specific duties apply.

Finance should support gross revenue and revenue-mix inputs; privacy or data governance should define the consumer-and-household counting method and sale or sharing classification; corporate legal should map control and common branding; and privacy or legal should approve the conclusion.

Keep the legal-entity chart, California-business facts, financial statements, CPI source, consumer-and-household counting logic, duplicate and identity-resolution rules, sale and sharing analysis, group-company data transfers, exclusions, calculation date, and signed decision. For a close result, record the monitoring metric, owner, alert level, and implementation lead time.

A threshold conclusion does not decide whether a particular data set or processing activity is exempt. Analyze entity applicability first, then apply statutory exemptions and role-specific rules to the relevant information and activity.

A joint venture or partnership composed of businesses in which each has at least a 40 percent interest is treated as a business, and each constituent business is separately treated as a business. The statute limits sharing of personal information contributed to the venture between the constituent businesses. An otherwise uncovered person that does business in California can also voluntarily certify to the CPPA that it complies with and agrees to be bound by the CCPA.

Complete the review early enough to implement notices, rights handling, opt-out controls, contracts, training, and recordkeeping when status changes. The revenue route is tested as of January 1 using preceding-calendar-year revenue, while the volume and revenue-mix routes use annual activity. The analysis therefore needs a dated cut-off, a documented treatment of incomplete year data, and an implementation owner.

A threshold memo should state the result for every route, the sources and assumptions, unresolved classification issues, entities brought in through control or joint-venture rules, and the next review trigger.