Join Us Now for Exclusive Insights!
·

CCPA Who Does It Apply To in 2026: 7 Live Checks for California Scope

CCPA who does it apply to in 2026: 7 live checks on California scope, the $26.625M revenue threshold, the 100,000 consumer-or-household test, and the 50% data-revenue rule.

Editorial illustration showing a California privacy compliance review with threshold cards for revenue, consumer volume, and data monetization, plus subtle visible branding text DataShyre.com

CCPA Who Does It Apply To in 2026: 7 Live Checks for California Scope

The real value in ccpa who does it apply to shows up when you debug it like a live system. A banner can render perfectly and still leak requests, misfire tags, or drift after the next plugin or theme update.

The linked DataShyre references add background, but the useful work here is in troubleshooting, release checks, and runtime verification on the live stack.

If you want the surrounding California context first, start with these guides to California consumer privacy, California Data Privacy Protection Act, and CCPA cookie consent requirements. This page stays tighter. It is the seven-check version I would use this week to decide whether a business is in scope and what that answer means operationally.

Editorial illustration showing a California privacy compliance review with threshold cards for revenue, consumer volume, and data monetization, plus subtle visible branding text DataShyre.com

1. Start with the short statutory answer, not the internet myth

The California Attorney General’s consumer-facing FAQ still gives the cleanest starting point. It says the CCPA applies to for-profit businesses that do business in California and meet any of the following:

  1. have a gross annual revenue above the statutory amount;
  2. buy, sell, or share the personal information of 100,000 or more California residents or households; or
  3. derive 50% or more of annual revenue from selling California residents’ personal information.

That means the scope test is not just a big-company revenue test.

A business can fall into CCPA scope because of scale, because of the volume of California data it handles, or because data monetization is central to the business model.

2. Check whether you are really the kind of entity the law targets

The first filter is easy to say and surprisingly easy to skip in practice.

The CCPA is aimed at for-profit businesses doing business in California. The Attorney General’s FAQ also says the law generally does not apply to nonprofit organizations or government agencies.

That does not make the rest of your stack irrelevant.

If a nonprofit relies on a for-profit vendor, ad-tech partner, analytics company, or consumer-data platform, that separate company may still have to assess its own status under the law. In other words, “our customer is a nonprofit” is not the same thing as “our business is out of scope.”

So before you start counting households or arguing about thresholds, confirm the entity analysis:

  1. Is the entity for-profit?
  2. Is it doing business in California?
  3. Is this the business that decides why and how California personal information is processed?

If the answer is yes, move to the thresholds.

3. Use the current adjusted revenue threshold, not the original headline number

Many articles still repeat the original $25 million figure without mentioning the adjustment rule.

The CPPA’s current monetary-threshold page says that, effective January 1, 2025, the annual gross revenue amount in the definition of business increased to $26,625,000. That is the number teams should be using in 2026 unless California updates it again in the next odd-numbered cycle.

Two practical reminders matter here:

  1. the test is gross annual revenue, not profit;
  2. passing this one threshold by itself can bring a business into scope, even if the business does not process 100,000 California residents or households and does not earn half its revenue from selling personal information.

For operating teams, this means the revenue question should be part of the annual privacy review, not an afterthought delegated only to legal or finance.

4. Do not underestimate the 100,000 consumer-or-household threshold

The second trigger is where a lot of digital businesses misread their own exposure.

The Attorney General’s FAQ says the law applies if a business buys, sells, or shares the personal information of 100,000 or more California residents or households. That can catch businesses that are not especially large by revenue standards but do have substantial California reach through ecommerce, mobile apps, audience building, analytics-linked user profiles, or broad lead-generation systems.

This threshold matters because it is not limited to old-school data brokers.

It can matter for:

  1. consumer apps with large California user bases;
  2. retailers with heavy California web traffic;
  3. media, advertising, or affiliate businesses that share audience data;
  4. SaaS products serving high-volume California end users through their customers.

The discipline here is operational, not rhetorical. Count what the business is actually buying, selling, or sharing, and make sure privacy, product, analytics, and ad operations are all using the same definition.

5. The 50% revenue test is narrower, but riskier when it fits

The third trigger is the monetization test.

If 50% or more of annual revenue comes from selling California residents’ personal information, the business can be in scope even if it is much smaller than the adjusted revenue threshold. That is the classic danger zone for data resellers, list businesses, audience businesses, and companies whose economics rely heavily on personal-data monetization.

This is also where California’s current enforcement posture makes the scoping question more urgent. In January 2026, CalPrivacy announced new enforcement actions against data brokers, including a decision requiring Datamasters to pay a fine and stop selling Californians’ personal information, plus a separate fine against S&P Global for failing to register as a data broker.

If a business is anywhere near this revenue mix, the right move is not to debate labels. It is to map the revenue stream, the source data, the contracts, and the consumer-rights flow in detail.

6. In 2026, being in scope can trigger more than notices and request handling

This is the part older scope articles often miss.

The CPPA’s rulemaking page confirms that California’s updated CCPA regulations became effective on January 1, 2026. The final regulations say that when processing presents “significant risk to consumers’ privacy,” a business must conduct a risk assessment “before initiating that processing.”

The rules then identify several activities that count as significant-risk processing, including:

  1. selling or sharing personal information;
  2. processing sensitive personal information;
  3. using automated decisionmaking technology for a significant decision concerning a consumer; and
  4. using personal information to train certain automated decisionmaking or recognition technologies.

That does not create a new fourth applicability threshold.

But it does mean that once your business is in scope, some common processing choices create extra compliance work right away. A company can answer the keyword question correctly, then still fail on the next question: what must we document, review, and approve before this processing starts?

Workflow illustration showing CCPA scope analysis moving from for-profit and California nexus checks into revenue, 100,000 household, and 50% data-revenue tests, then into 2026 risk-assessment and enforcement checks with subtle visible branding text DataShyre.com

7. Enforcement shows why scope decisions need evidence, not guesswork

California has been giving businesses a very practical roadmap through enforcement.

The Attorney General’s public CCPA enforcement examples still highlight problems such as failing to honor Global Privacy Control, using trackers without a compliant opt-out path, and missing or defective Do Not Sell My Personal Information links. More recently, the CPPA’s September 30, 2025 announcement about Tractor Supply said the company agreed to pay $1.35 million and change its practices over CCPA violations involving privacy notices, job-applicant rights, opt-out mechanisms including opt-out preference signals, and missing contractual protections.

That is what makes the keyword more than a definitional exercise.

If a business gets the scope call wrong, the fallout usually shows up somewhere concrete:

  1. no valid privacy policy or notice at collection;
  2. no real opt-out path for selling or sharing;
  3. poor handling of job-applicant, employee, or contractor data;
  4. weak service-provider or third-party contracts;
  5. no documentation for high-risk processing under the 2026 rules.

A quick applicability worksheet for this week

If you need a fast internal screen, use these seven questions in order:

  1. Is the entity a for-profit business?
  2. Is it doing business in California?
  3. Did annual gross revenue exceed $26,625,000?
  4. Does it buy, sell, or share the personal information of 100,000 or more California residents or households?
  5. Does it derive 50% or more of annual revenue from selling California residents’ personal information?
  6. If the answer is yes on scope, does it sell or share personal information, process sensitive personal information, or use covered ADMT in ways that trigger a 2026 risk assessment?
  7. Are notices, opt-out mechanisms, preference-signal handling, and contracts already aligned with that answer?

If the business hits yes on the first two questions and yes on any one of Questions 3 through 5, the safer assumption is that CCPA compliance work should already be active.

FAQ

Does the CCPA apply only to businesses above $25 million?

No. The current adjusted gross-revenue threshold is $26,625,000, and it is only one of three ways a for-profit business can fall into scope.

Does the CCPA generally apply to nonprofits?

The Attorney General’s FAQ says the CCPA generally does not apply to nonprofit organizations or government agencies.

Why does this scope question matter more in 2026?

Because California’s updated regulations took effect on January 1, 2026, and some in-scope processing now requires documented risk assessments before the activity begins.

Are job applicants part of the current enforcement picture?

Yes. The CPPA’s September 30, 2025 Tractor Supply announcement said the decision was the first to address the importance of job-applicant privacy rights under the CCPA.

Bottom line

The cleanest answer to ccpa who does it apply to in 2026 is still the official one: a for-profit business doing business in California that meets any one of the law’s threshold tests.

The fastest way to judge ccpa who does it apply to is to test it the way a broken deployment would expose it: before consent, after consent, and again after a stack change.

Sources

—

Published: October 23, 2026. Updated against current official California regulator and government materials available at publication time.