US CPRA Applicability Test

Use the preceding calendar year's facts. As of 2025, the adjusted gross-revenue threshold is $26.625 million; the alternatives are buying, selling, or sharing personal information of 100,000 or more California consumers or households, or deriving at least half of annual revenue from selling or sharing consumers' personal information.

The CCPA generally does not apply to nonprofits or government agencies, but covered-business analysis also includes certain commonly controlled entities, joint ventures, and voluntary certifications. Employment-related and business-to-business personal information are no longer covered by the former temporary exemptions, which expired after 2022.

Ownership should sit with the team that can change notices, rights intake, consent/opt-out interfaces, data sharing, retention, vendor terms, or security evidence, with privacy counsel reviewing edge cases.

Keep the Applicability Test decision, source, affected data and systems, implementation record, owner approval, exception rationale, and dated test or review evidence together.

The main risk is applying a general California privacy answer without checking the facts that control this Applicability Test decision: entity scope, data category and purpose, consumer context, recipient role, applicable exception, and current regulatory text.

Reassess before a material change to the data, purpose, interface, vendor, recipient role, system logic, or source text.

Use a CPRA workflow that captures threshold status, data categories, consumer rights, opt-out signals, vendor role, retention logic, risk/cyber/ADMT trigger, owner, and review date.

The output should be a threshold memo, notice update, DSAR workflow, opt-out/GPC implementation record, vendor clause map, risk-assessment intake, or audit evidence pack.