CCPA/CPRA applies to for-profit businesses doing business in California that meet at least one of three thresholds: annual gross revenues above a set amount, buying or selling personal information of 100,000 or more consumers or households annually, or deriving 50% or more of revenues from selling or sharing personal information. Verify the current revenue threshold with the CPPA.
Nonprofit organizations are generally exempt, though service providers and contractors working with covered businesses face contractual obligations. Businesses based outside California are not exempt if they do business in California and meet a threshold - CCPA/CPRA has no physical presence requirement. A common error is assuming out-of-state businesses are automatically exempt. Small businesses that do not meet any threshold are not covered, but this should be reassessed annually as volumes grow.
Keep Exploring
%20(white).png)
.png)