DPO SchoolDPO School

California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)

California privacy law (CCPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The CCPA applies to for-profit businesses that do business in California, decide why and how consumers' personal information is processed, and meet one of three tests: annual gross revenue above an inflation-adjusted threshold ($26,625,000 since 2025-01-01), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information. Unlike most state laws, it protects California residents in every role, including employees, job applicants and business contacts, because those exemptions expired on 2023-01-01. Financial and health exemptions are data-level: information covered by the GLBA or HIPAA is excluded, but the business itself remains covered for its other data.

Key points

  1. Revenue test: gross revenue in the preceding calendar year above $25,000,000 as adjusted for inflation; the CPPA set it at $26,625,000 from 2025-01-01, with the next adjustment due 2027-01-01.

    Section: Cal. Civ. Code §§ 1798.140(d)(1)(A), 1798.199.95(d)

  2. Volume test: alone or with others, annually buys, sells or shares personal information of 100,000 or more consumers or households.

    Section: Cal. Civ. Code § 1798.140(d)(1)(B)

  3. Data-revenue test: 50 percent or more of annual revenue from selling or sharing personal information.

    Section: Cal. Civ. Code § 1798.140(d)(1)(C)

  4. Commonly branded affiliates that share personal information with the business, certain joint ventures, and entities that voluntarily certify are also covered.

    Section: Cal. Civ. Code § 1798.140(d)(2) to (4)

  5. Nonprofits and government agencies are generally outside the definition of business, which requires a for-profit purpose.

    Section: Cal. Civ. Code § 1798.140(d)(1)

  6. Data-level exemptions: information subject to the GLBA, the California Financial Information Privacy Act or the Farm Credit Act, and HIPAA protected health information and CMIA medical information; the breach action still applies to GLBA data.

    Section: Cal. Civ. Code § 1798.145(c)(1)(A), (e)

  7. The employee and business-to-business exemptions became inoperative on 2023-01-01, so workforce and B2B contact data are fully covered.

    Section: Cal. Civ. Code § 1798.145(m)(4), (n)(3)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the California statute

Reference material, not legal advice.