Does California’s privacy law (CCPA/CPRA) apply to my business?
The short answer
Only if you’re a for-profit business that meets one of its thresholds: annual revenue over US$26,625,000, buying, selling or sharing personal information of 100,000 or more Californians, or earning half your revenue from selling or sharing personal information. Many small businesses fall below all three.
Applies in California · US
If it applies to you
- Tell people what you collect at the time you collect it.
- Delete people’s data when they ask, after verifying who they are, and tell your providers to delete it too.
- Offer a “Do Not Sell or Share My Personal Information” option. Selling or sharing data about under-16s needs their opt-in.
- Keep personal information reasonably secure: after a breach caused by poor security, consumers can sue for US$107–$799 each per incident.
The California Privacy Protection Agency can fine up to US$2,663 per violation, or US$7,988 if the violation is intentional or involves under-16s.
Other US states
As of October 2026, 23 US states have passed comprehensive consumer privacy laws, according to the IAPP’s tracker, and 19 of them are already in force. Each has its own thresholds, and a few apply to small businesses in some situations, such as selling sensitive data.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- CCPA/CPRA (California)
- California’s privacy law: residents can see, delete and correct their data and stop it being sold.
- Personal data
- Any information about an identifiable person — names, emails, addresses, health notes, photos. Privacy laws control how you collect, store and protect it.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.