Confirm California scope and then identify which CPRA specific obligations activate.
Grounded in the California statute, CPPA regulations, and the 2026 California rule changes.
Structured answer sets in this page tree.
Cited legal and guidance references.
A CPRA applicability test should answer both whether the business is in scope and which special California workstreams must be built on top of the baseline programme.
The same California business thresholds remain the starting point: more than 25 million dollars in annual gross revenue, 100,000 or more consumers or households, or 50 percent of annual revenue from selling or sharing personal information.
After scope is confirmed, identify whether the business uses or discloses sensitive personal information outside permitted purposes, sells or shares information, relies on service providers or contractors, or runs processing that may trigger risk assessment, cybersecurity audit, or ADMT obligations.
The output should be a living scope and trigger register that explains not only why the business is covered, but also why certain CPRA workstreams do or do not apply.
Assessment Autopilot can take California CPRA Applicability Test from deciding whether these obligations apply in practice to a reusable workflow inside Sorena. Teams working on California CPRA can keep owners, evidence, and next steps aligned without copying this guide into separate documents.
Start from California CPRA Applicability Test and turn the guidance into owned tasks, evidence requests, and review checkpoints.
Review your current process, evidence gaps, and next steps for California CPRA Applicability Test.