- CCPA does not automatically cover every small business or all companies in the USA.
- The scope depends, among other things, on conducting business in California and meeting statutory criteria.
- In certain situations, a consumer may request access to data, its deletion, correction, or opt-out of the sale or sharing of data.
- Thresholds and definitions should be checked according to current regulations, not just based on the number of employees.
How to determine if the California privacy law applies to a company, what rights consumers have, and how to prepare for handling requests.
Status checked: November 2, 2026. We are not a law firm. This text is for informational and educational purposes only and does not constitute individual legal advice. Before making decisions, check the regulations applicable to your location and type of business and consult with a lawyer or other appropriate specialist.
Who May Be Affected by CCPA
The California Consumer Privacy Act, amended by the California Privacy Rights Act, grants specific rights to California residents and imposes obligations on entities that fall within the statutory definition of a business. The location of an office outside California does not automatically resolve the issue. Check if the company conducts business in the state, what data it collects, and whether it meets other criteria.
According to the California agency CPPA, one of the thresholds is an annual gross revenue in the previous year of at least the statutory threshold, adjusted to $26.625 million starting in 2025. Other criteria relate to the number of residents or households whose data is bought, sold, or shared, as well as a portion of revenue from the sale or sharing of data. These are separate criteria, so a company below the revenue threshold is not always exempt.
Check the revenue threshold and other conditions in the current text of the law and CPPA explanations. The regulations also include definitions, exceptions, and rules regarding affiliated entities. A simple count of customers or employees is not sufficient for assessment.
What Data and Actions to Check
Personal data may include not only names and addresses but also online identifiers, approximate or precise location information, and purchase history, if they fall within the statutory definition. List forms, store systems, advertising, analytics, payment processing, and external vendors. Determine what information each tool transmits and for what purpose.
The terms “sale” and “sharing” have statutory meanings. Do not assume that an issue arises only when the company receives money for the customer database. Pay particular attention to advertising technologies and the transmission of identifiers to vendors. Whether a specific action is subject to the opt-out law depends on the facts and applicable exceptions.
Consumer Rights and Company Response
Individuals covered by the law may have the right to information about their data and how it is used, to request access, deletion, or correction of data, and to opt-out of the sale or sharing of data. Some rights have exceptions and conditions. In certain situations, the use or disclosure of sensitive personal data may also be limited.
Prepare a method for accepting requests, verifying identity where required, and passing tasks to vendors. Do not collect additional information thoughtlessly if identity can be safely established otherwise. Document who is responsible for deadlines, exceptions, responses, and documentation.
Example: Store and Advertising
A store ships products to customers in California and uses an external advertising tool. The owner should first determine whether the company is subject to CCPA, then check the data flow from the website, contract terms, and the operation of the tool. Only after this analysis can the obligations regarding information and opt-out be accurately determined. Simply pasting a privacy policy template will not answer these questions.
If you also operate in other states or target the EU, separately check the applicable law for each market. Compliance with CCPA does not automatically mean compliance with GDPR and vice versa.
How to Handle a Data Request
Upon receiving a request, record the date and scope of the request. Check if the requesting individual is a consumer under the law and if the company is a covered entity. Then determine which systems the request pertains to: store, customer service system, email, advertising platform, and copies held by vendors.
If the request pertains to data deletion, separate information stored under a specific exception from that which must be deleted. Do not automatically promise to delete every piece of information: security, transaction completion, and other statutory exceptions may be significant. Provide the outcome along with justification according to the requirements of applicable regulations.
For opt-out requests, check if the settings actually block the relevant data flows, not just close the banner. Test functionality in different browsers and on devices supported by the store. Also, determine how to handle applicable privacy preference signals, if any.
Frequently Asked Questions
Can a company outside California be subject to CCPA?
Yes, the location of the headquarters alone does not exclude the application of the law. The statutory conditions, including conducting business in California, are what matter.
Does every company have to fulfill every deletion request?
No. Rights are subject to conditions and exceptions that must be assessed for each specific request.
Related Guides
Sources
| Document | What it Contains |
|---|---|
| CPPA: FAQs | Scope, rights of residents, and thresholds. |
| California Attorney General: CCPA | Business obligations and consumer rights. |
Comments (0)
No comments yet. Be the first!