CCPA threshold calculator

What it works out

The CCPA covers a for-profit firm doing business in California only if it passes one of three tests in Civil Code § 1798.140(d)(1): revenue, the volume of data it buys, sells or shares, or the share of revenue that comes from selling or sharing. The CPPA’s regulations then add four duties with lines of their own: a risk assessment, a cybersecurity audit, a written training policy and published request metrics.

The calculator runs both stages on the same figures and draws each test as a gauge, so you can see how far a figure sits from its line, not just whether it crossed. It covers California alone; to test the GDPR and the other states at once, use which privacy laws apply.

1. Pick the kind of organisation and confirm you do business in California.
2. Enter last calendar year’s gross revenue, the share of it from selling or sharing data, and how many California consumers or households you bought, sold or shared data on.
3. Read the three gauges: one “met” is enough to make you a CCPA business.
4. Fill stage 2 with the wider counts and tick what you do with the data; the duty list shows what switches on and any date attached.

Worked example

The pre-filled firm delivers meal kits from Oakland: 60 staff and $19,800,000 in revenue last year, none of it from selling data. Its site runs ad pixels that pass the data of 140,000 California customers to ad networks for cross-context behavioural advertising. It processed the data of 320,000 consumers and households in all, and its delivery app collects the precise geolocation of 38,000 of them. Revenue sits $6,825,000 under the line, so the pixels decide it: 140,000 is over 100,000, the data test is met, and the firm is covered.

Three things show up. Removing the pixels takes the firm out of the CCPA at today’s revenue, because sharing for ads is what put it in. Growth puts it back in through the revenue test, pixels or not. And at $31,000,000 the cybersecurity audit arrives even with no data shared: the second route in § 7120(b) pairs the revenue test with 250,000 or more consumers or households processed, and the firm processes 320,000. The risk assessment follows the precise geolocation, which is sensitive personal information, whichever way the revenue goes.

How to count each figure

Most wrong answers come from counting the wrong thing. The statute’s definitions settle each box:

• Revenue is fixed on 1 January: the test asks whether, as of 1 January of the calendar year, the firm had gross revenue over the line in the preceding calendar year. A firm that crosses the line in March is tested on that year’s revenue on the next 1 January.
• A consumer is any natural person who is a California resident, however identified. Staff, job applicants and business contacts count: their partial exemptions in § 1798.145(m) and (n) became inoperative on 1 January 2023.
• A household is a group of consumers living at the same residential address who share use of common devices or services. Count a household once, not each person in it.
• Selling is passing personal information to a third party for money or other valuable consideration; sharing is passing it for cross-context behavioural advertising, paid or not. The data test counts people whose data you buy, sell or share “alone or in combination”, so add up every channel, but count each person once.
• Processing is any operation on personal information, automated or not, so the audit counts in stage 2 are often close to your whole California customer and contact base.

The 10,000,000 line counts consumers only, no households, and adds two verbs the 100,000 data test lacks: data you receive for commercial purposes, and (for the metrics in § 7102) data you otherwise make available. Because receiving counts, a firm that never sells or shares can still pass it, which is why the calculator reads the two counts separately.

Jurisdiction notes

The revenue line moves every odd year

The revenue test is $26,625,000, CPI-adjusted from $25,000,000 on 1 Jan 2025, and the agency adjusts it again on 1 January of every odd year, next on 1 January 2027. The same cycle moves the fine amounts. What the law covers beyond the thresholds is in what the CCPA is.

Groups, joint ventures and volunteers

A firm that controls or is controlled by a covered business is itself covered if the two share common branding and the business shares consumers’ data with it. Control means more than 50 percent of a class of voting shares, control over electing most of the directors, or a controlling influence over management. A joint venture or partnership of businesses that each hold at least 40 percent is a business too, and a firm can volunteer: it certifies to the agency that it complies and agrees to be bound.

Nonprofits and data brokers

Paragraph (d)(1) covers only entities run for the profit or financial benefit of their owners, so a nonprofit is outside it unless the group rule above reaches it. A firm that knowingly collects and sells the data of consumers it has no direct relationship with is a data broker under a second law, the Delete Act, and must register by 31 January after each year it meets that definition. The California data broker registry covers who is on the list.

Once you are covered

The thresholds decide whether the law reaches you; the duty list decides the work. Fines run up to $2,663 per violation, or $7,988 per intentional violation or one involving consumers the business knows are under 16; the cases so far are in CCPA penalties.

1. Turn the duty list into an owned plan with the CCPA compliance checklist.
2. If stage 2 lit the risk assessment, draft it in the privacy impact assessment template, which prints as a US state assessment.
3. For what the 2020 vote added on top of the original act, from sensitive data to the agency itself, read what the CPRA is.