--- title: "California privacy law (CCPA): applicability" canonical: "https://dposchool.com/state-privacy-laws/state/california/applicability" source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) # California privacy law (CCPA): applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) The CCPA applies to for-profit businesses that do business in California, decide why and how consumers' personal information is processed, and meet one of three tests: annual gross revenue above an inflation-adjusted threshold ($26,625,000 since 2025-01-01), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing personal information. Unlike most state laws, it protects California residents in every role, including employees, job applicants and business contacts, because those exemptions expired on 2023-01-01. Financial and health exemptions are data-level: information covered by the GLBA or HIPAA is excluded, but the business itself remains covered for its other data. ## Key points 1. Revenue test: gross revenue in the preceding calendar year above $25,000,000 as adjusted for inflation; the CPPA set it at $26,625,000 from 2025-01-01, with the next adjustment due 2027-01-01. Section: [Cal. Civ. Code §§ 1798.140(d)(1)(A), 1798.199.95(d)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 2. Volume test: alone or with others, annually buys, sells or shares personal information of 100,000 or more consumers or households. Section: [Cal. Civ. Code § 1798.140(d)(1)(B)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 3. Data-revenue test: 50 percent or more of annual revenue from selling or sharing personal information. Section: [Cal. Civ. Code § 1798.140(d)(1)(C)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 4. Commonly branded affiliates that share personal information with the business, certain joint ventures, and entities that voluntarily certify are also covered. Section: [Cal. Civ. Code § 1798.140(d)(2) to (4)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 5. Nonprofits and government agencies are generally outside the definition of business, which requires a for-profit purpose. Section: [Cal. Civ. Code § 1798.140(d)(1)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 6. Data-level exemptions: information subject to the GLBA, the California Financial Information Privacy Act or the Farm Credit Act, and HIPAA protected health information and CMIA medical information; the breach action still applies to GLBA data. Section: [Cal. Civ. Code § 1798.145(c)(1)(A), (e)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 7. The employee and business-to-business exemptions became inoperative on 2023-01-01, so workforce and B2B contact data are fully covered. Section: [Cal. Civ. Code § 1798.145(m)(4), (n)(3)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) ## Sources - [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) - [CPPA, Updated monetary thresholds in the CCPA (effective 2025-01-01)](https://www.cppa.ca.gov/regulations/cpi_adjustment.html) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) Reference material, not legal advice. ## Other topics for California - [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/california/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents