Determining CCPA applicability is the first and most important step in understanding your privacy obligations.
With the expanded requirements introduced under the California Privacy Rights Act (CPRA) and new inflation adjustments taking effect in 2026, the scope of who must comply has shifted. A business that was exempt last year may now fall within scope due to updated revenue thresholds or expanded definitions around “data brokerage.”
This guide explains the three legal thresholds that trigger coverage, clarifies who must comply with CCPA even outside California, and links to deeper resources on key data categories.
CCPA applicability checklist: Quick “Am I covered?” logic flow (2026)
Use this quick decision sequence to assess your status:
- Are you a for-profit entity doing business in California?
(Yes → Continue)
- Do you meet ANY ONE of the following 3 criteria?
- A. Annual Global Gross Revenue > $26.625 million
- B. Buy/Sell/Share data of > 100,000 CA consumers or households
- C. Derive > 50% of annual revenue from selling/sharing data
- Result: If you checked A, B, or C, the CCPA generally applies.
CCPA revenue threshold 2026 explained: Understanding the $26.6M rule
Many businesses assume the revenue threshold applies only to money made within California, but the scope is broader. Effective January 1, 2025, the original $25 million statutory threshold is adjusted for inflation. For the 2026 compliance year, your business is covered if its annual gross revenues exceed $26,625,000.
Global revenue rule under CCPA: why worldwide revenue counts
The law evaluates your full economic footprint, not just your activity within the state.
- Global scope: This threshold typically refers to total global gross revenue, not revenue earned in California. For example, if your company is based in France, generates $30M worldwide, and earns only $100k from California customers, you likely meet this threshold if you are considered to be “doing business” in the state.
- Inflation updates: The CPPA updates this monetary threshold every two years based on the Consumer Price Index (CPI).
Compliance Tip: The statute (Civil Code § 1798.140) still lists “$25,000,000,” but footnotes that the figure is updated under § 1798.199.95(d). Use the adjusted $26.625M amount in your assessments.
CCPA data volume threshold: does 100,000 consumers apply to your business?
This threshold often surprises smaller companies because it focuses on data volume, not revenue. Your business falls under the CCPA if it annually buys, sells, or shares the personal information of 100,000 or more California consumers, households, or devices.
The 275 visitors rule: how website traffic triggers CCPA coverage
This is the most common pitfall for SMBs. You do not need 100,000 customers, the law counts unique identifiers such as cookies, device IDs, and IP addresses.
- The calculation:
100,000 unique visitors ÷ 365 days ≈ 274 visitors per day
- The reality:
If your website averages around 275 daily visitors from California, and you use tools such as Google Analytics, Meta Pixel, or similar trackers, you are collecting personal information from 100,000 “consumers or devices” each year.
- The verdict: If this applies, you are required to comply.
Pro Tip #1: Adopting CCPA data minimization strategies may help reduce your identifier volume and keep you below the threshold.
Pro Tip #2: Check your Google Analytics “California” user count for the past 12 months. If “Users” exceed 100,000, you are in scope.
CCPA data broker threshold: understanding the 50% revenue rule (2026)
If your business model relies heavily on data monetization, pay close attention to how your revenue is generated. You fall within the CCPA if 50% or more of your annual revenue comes from selling or sharing personal information.
Delete Act (SB 362) requirements for 2026: what data brokers must do
Meeting this threshold often means you qualify as a Data Broker, a business that knowingly collects and sells personal information from consumers with whom it does not have a direct relationship.
Starting in 2026, additional Delete Act obligations apply:
- Registration: Register with the CPPA by January 31 each year and pay the $6,000 registration fee
- DROP integration: Integrate with the state’s DROP Platform, enabling consumers to delete their information across all registered brokers via a single request
Does CCPA apply outside California? Understanding extraterritorial coverage (2026)
The CCPA applies based on consumer location, not business location. A physical presence in California is not required.
Any organization that meets one or more thresholds and collects personal information from California residents is generally covered.
Common scenarios
