A business must clear $26,625,000 in annual gross revenue, or buy, sell, or share the personal information of 100,000 or more California consumers, households, or devices, or earn 50% or more of its revenue from selling personal information, before the CCPA applies to it at all, according to Cal. Civ. Code section 1798.140(d)(1) as adjusted by the California Privacy Protection Agency effective January 1, 2025. A company under all three thresholds is not a covered "business" under the statute, no matter how much personal data it touches.
Those numbers rarely get much attention next to the headline fines and settlement figures that dominate CCPA coverage, but they are the actual gate a company has to pass through before any of the law's obligations, disclosures, or penalties apply. CCPA sits alongside a growing tracker of US state privacy laws, most of which use their own, different revenue and consumer thresholds, so clearing California's bar does not automatically mean clearing another state's. Below is what each threshold means in practice, how the newer 2025 cybersecurity-audit rules add a separate and higher bar, and what the state's own impact assessments say about how many businesses and how much money are actually affected.
What are the three CCPA applicability thresholds?
A for-profit entity that does business in California and collects California residents' personal information is a covered "business" under the CCPA if it meets at least one of three tests set out in Cal. Civ. Code section 1798.140(d)(1). It does not need to meet all three, or even two.
The first test is annual gross revenue: more than $26,625,000 in the preceding calendar year, a figure the California Privacy Protection Agency recalculates every odd-numbered year using the California Consumer Price Index. The original 2018 statute set this at a flat $25,000,000; the first CPI adjustment, effective January 1, 2025, raised it to $26,625,000, and that amount holds through 2026 since the next recalculation is not due until January 1, 2027.
The second test counts data volume rather than revenue: a business that alone or in combination annually buys, sells, or shares the personal information of 100,000 or more consumers, households, or devices meets the CCPA's definition regardless of how small its revenue is. The CPRA raised this from the original CCPA's 50,000 threshold when it took effect on January 1, 2023, doubling the data-volume bar and pulling some smaller, high-volume data brokers and ad-tech companies out of scope while leaving larger ones in.
The third test looks at business model: any entity that derives 50% or more of its annual revenue from selling or sharing consumers' personal information is covered, even with modest total revenue and well under 100,000 consumers. This clause is aimed squarely at data brokers and similar businesses whose core product is personal information itself.
Figure 1: The CCPA's revenue threshold has moved once since 2020, from a flat $25 million to a CPI-indexed $26.625 million. Source: Cal. Civ. Code section 1798.140(d)(1)(A); California Privacy Protection Agency CPI adjustment, effective January 1, 2025.
Does the CCPA apply to your business?
Because the three thresholds are independent, a company can trip the CCPA wire through any single path. A small business with modest revenue and a small user base but a heavy trade in personal information can still be covered through the 50%-of-revenue test, while a company with far more than 100,000 users but low revenue and no data-selling business model can still fall outside the law entirely if it stays under both the revenue and volume thresholds.
Figure 2: Any one of the three thresholds is sufficient to bring a business into CCPA scope. Source: Cal. Civ. Code section 1798.140(d)(1)(A)-(C).
A company with $800,000 in annual revenue and a few thousand customers is a textbook example of a business outside CCPA scope on all three counts, but that status is not permanent. Growth in revenue, a pivot toward selling customer data, or crossing 100,000 users in a single year can each independently pull a previously exempt company into scope starting the next calendar year, which is one reason a privacy policy that already covers CCPA-style disclosures is worth having in place before a business actually needs one.
Is there a separate threshold for cybersecurity audits and AI rules?
Yes, and it is meaningfully higher than the baseline CCPA thresholds. California finalized new CCPA regulations on annual cybersecurity audits, privacy risk assessments, and automated decision-making technology in 2025, approved by the Office of Administrative Law on September 23, 2025. These rules apply only to businesses that already meet the standard CCPA definition and additionally cross a second, narrower bar: over $25 million in annual revenue combined with processing the personal information of 250,000 or more California consumers or households, or the sensitive personal information of 50,000 or more consumers or households, or deriving 50% or more of revenue from selling or sharing personal information. Sensitive personal information under the CPRA includes health and biometric data, so a business that stays under the 100,000-consumer baseline threshold but processes even a modest volume of biometric data covered by state-specific laws like BIPA, or health data outside HIPAA's reach, can trip the 50,000-record sensitive-information trigger well before it comes close to the standard consumer-volume threshold.
Figure 3: The California Privacy Protection Agency's own first-year cost estimate for its 2025 rules, split by requirement. Source: California Privacy Protection Agency, Standardized Regulatory Impact Assessment, 2024-2025.
The cybersecurity-audit certification deadline is staggered by revenue size rather than applying to every covered business on the same date. Businesses with more than $100 million in 2028 revenue must submit their first certification by April 1, 2028; those with $50 million to $100 million have until April 1, 2029; and businesses under $50 million in revenue get until April 1, 2030, roughly two extra years compared to the largest companies to build out an audit program.
Figure 4: The thresholds and their enforcement dates have both moved several times since 2018. Source: Cal. Civ. Code sections 1798.140, 1798.199.95; CPPA final regulations, September 2025.
How many businesses and how much money are actually affected?
The California Privacy Protection Agency's final Standardized Regulatory Impact Assessment estimates that roughly 52,326 businesses are covered by the 2025 cybersecurity audit, risk assessment, and automated decision-making technology rules specifically, more than double an earlier draft assessment's estimate of 25,167 businesses reviewed by outside counsel in 2024. The agency puts the combined first-year compliance cost for all covered businesses at $3.5 billion, split across roughly $2.1 billion for cybersecurity audits, $0.8 billion for automated decision-making technology pre-notice and opt-out provisions, $0.4 billion for the updated core CCPA regulations, and $0.2 billion for risk assessments.
Figure 5: California's CPI-based adjustment mechanism raises statutory penalty and damages amounts alongside the revenue threshold. Source: California Privacy Protection Agency, Updated Monetary Thresholds in CCPA, effective January 1, 2025.
That same CPI mechanism that lifted the revenue threshold to $26,625,000 also raised the CCPA's statutory penalty and private-lawsuit figures on the same schedule. The private right of action for a qualifying data breach now runs $107 to $799 per consumer per incident, up from the original $100 to $750 range, and administrative or civil fines rose from $2,500 to $2,663 for a standard violation and from $7,500 to $7,988 for an intentional violation or one involving a minor's data. All of these figures reset again on January 1, 2027, the next scheduled odd-year adjustment.
The Bottom Line
The CCPA's thresholds are not a single number but three independent doors, and clearing any one of them is enough to bring a business into scope: $26,625,000 in revenue, 100,000 consumers' worth of data traded per year, or a business model built on selling half its revenue's worth of personal information. Most small businesses stay under all three and remain outside the law entirely, but the 2025 cybersecurity-audit, risk-assessment, and AI rules add a second, higher bar that still reaches an estimated 52,326 businesses at a combined $3.5 billion in first-year cost, with the smallest covered businesses getting until 2030 rather than 2028 to comply. A business that is unsure which side of these thresholds it sits on, or expects to cross one within the next year or two, is better served building CCPA-style disclosures into its privacy policy now rather than scrambling once the next annual revenue check lands.
Frequently Asked Questions
What is the CCPA revenue threshold for a small business in 2026? $26,625,000 in annual gross revenue for the preceding calendar year, per Cal. Civ. Code section 1798.140(d)(1)(A) as adjusted by the California Privacy Protection Agency effective January 1, 2025. The adjustment is recalculated every odd-numbered year, so this figure holds through the end of 2026.
How many consumers can a small business handle before the CCPA applies? Up to 99,999 California consumers, households, or devices per year in personal information bought, sold, or shared. At 100,000 or more, a business meets the CCPA's second threshold regardless of revenue, per Cal. Civ. Code section 1798.140(d)(1)(B), a limit the CPRA lowered from the original CCPA's 50,000 in 2023.
Does the CCPA have a separate threshold for cybersecurity audits? Yes. A business needs over $25 million in annual revenue combined with processing 250,000 or more California consumers' or households' personal information, or 50,000 or more consumers' sensitive personal information, or deriving 50% or more of revenue from selling or sharing personal information, before the annual cybersecurity audit requirement applies, per the CPPA's regulations finalized in 2025.
How many California businesses are covered by the CCPA's 2025 cybersecurity and AI rules? Roughly 52,326 businesses, according to the California Privacy Protection Agency's final Standardized Regulatory Impact Assessment for the cybersecurity audit, risk assessment, and automated decision-making technology regulations approved in September 2025. That is more than double the 25,167 businesses an earlier draft assessment had estimated.
Where the Numbers Come From
- California Legislative Information. Cal. Civ. Code section 1798.140(d)(1)(A)-(C). Definition of "business" and the three applicability thresholds.
- California Privacy Protection Agency. "Updated Monetary Thresholds in CCPA." Effective January 1, 2025, posted December 17, 2024. Revenue threshold raised to $26,625,000; statutory damages and fine amounts updated.
- California Privacy Protection Agency. (2025). "California Finalizes Regulations to Strengthen Consumers' Privacy." Cybersecurity audit, risk assessment, and ADMT regulations approved by the Office of Administrative Law, September 23, 2025.
- California Privacy Protection Agency. Standardized Regulatory Impact Assessment, ISOR Appendix A. 52,326 businesses covered; $3.5 billion first-year cost, split by requirement.
- White & Case LLP. (2025). "CPPA Finalizes Rules on ADMT, Risk Assessments, and Cybersecurity Audits Requirements Under the CCPA." Threshold and staggered certification-deadline summary.
- California Chamber of Commerce. (2024). Comments on the CCPA Standardized Regulatory Impact Assessment, citing the draft 25,167-business estimate later revised upward in the final SRIA.
Note: All figures verified as of November 2026. The $26,625,000 revenue threshold and statutory penalty amounts are next scheduled to adjust on January 1, 2027; check the California Privacy Protection Agency's published thresholds before relying on these figures after that date.
