US CPRA Applicability Test

Start with the entity, not the product. The entity must generally be organized or operated for profit, collect consumers' personal information or have it collected on its behalf, do business in California, determine the purposes and means of processing consumers' personal information, and meet at least one statutory threshold. As of January 1 of the calendar year, the gross-revenue test looks at the preceding calendar year. The inflation-adjusted threshold has been more than $26.625 million since January 1, 2025. The alternatives are annually buying, selling, or sharing the personal information of 100,000 or more California consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing consumers' personal information. Record which threshold applies and the measurement period rather than carrying forward an old scope result.

Then test statutory extensions. An entity that controls or is controlled by a covered business, shares common branding with it, and receives consumers' personal information from that business may itself be covered; control includes ownership or voting power over more than 50 percent, control over selection of a majority of directors or similar managers, or power to exercise a controlling influence over management. A joint venture or partnership in which each business holds at least a 40 percent interest is treated as a business for the joint venture's processing, while each participant remains a separate business for its own processing. The statute also permits an entity to certify voluntarily to the Agency that it is bound by the CCPA.

Finally, analyze exemptions at the information and activity level. The statute contains rules for information governed by laws such as the CMIA, HIPAA, and GLBA, and for specified credit-reporting activity. Government agencies and nonprofit entities generally fall outside the definition of business. The former employee and business-contact exemptions expired on January 1, 2023, so those contexts cannot be excluded on that historical basis.

Privacy or legal should own the legal conclusion, while finance supplies revenue evidence, data governance supplies consumer and household counts, and corporate teams confirm ownership and branding. The decision record should make those inputs traceable instead of relying on a checkbox.

Keep a dated scope memorandum with the entity chart, California nexus, preceding-year calculations, data-set exemptions, assumptions, cited statutory provisions, approver, and next review trigger. If the conclusion is that the law does not apply, preserve enough evidence to reproduce that conclusion.

Revenue alone is not the only threshold. A business below $26.625 million can still be covered by the 100,000-consumer-or-household test or the 50-percent sale-or-sharing-revenue test. Conversely, a large entity still must satisfy the business definition and California nexus.

Count California consumers and households under the statutory definitions and document how duplicates, multiple devices, and records belonging to one household are handled. Determine whether an advertising or disclosure flow is a sale or sharing before excluding it from the count. Publicly available information and deidentified or aggregate consumer information have specific definitions; labels in a data catalog do not settle those tests.

Reassess after a merger, acquisition, new common brand, California launch, new monetization model, material data-flow change, or a change to the applicable threshold.

If the entity is covered, move from the scope memorandum to a data inventory and control plan for notices, consumer requests, sale and sharing opt-outs, opt-out preference signals, sensitive personal information, retention, reasonable security, and recipient contracts. Screen the 2026 risk-assessment, cybersecurity-audit, and ADMT regulations separately because each has its own trigger.

If the entity is not covered, retain the negative determination and schedule a review after the next calendar-year close or earlier if a trigger event occurs. A not-covered conclusion does not displace sector-specific privacy, security, breach, data-broker, or contract duties.