Does my business have to publish CCPA consumer request metrics?

Most businesses that meet the CCPA's ordinary thresholds never have to think about this duty. It only attaches at a scale most companies never reach, and the confusion online about the exact number is worth clearing up with the regulation's own text.

The threshold is 10,000,000 consumers, not 4 million

11 CCR Section 7102(a) applies to a business that knows or reasonably should know that it, alone or in combination, buys, receives for the business's commercial purposes, sells, shares, or otherwise makes available for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year. Ten million is the figure printed in the current regulations. If you have seen a smaller number attached to this duty, you are looking at an outdated or secondary source, not the operative text.

Scale matters here in both directions. The threshold counts personal information bought, received, sold, shared, or otherwise made available for commercial purposes, not merely personal information collected for your own internal use. And it is measured "alone or in combination," so affiliated or related data-handling activity can be aggregated toward the ten million figure rather than evaluated business by business.

The eight metrics you have to compile

Section 7102(a)(1) lists what a business over the threshold has to compile for the previous calendar year: the number of requests to delete, requests to correct, requests to know, and requests to access automated decisionmaking technology that the business received, complied with in whole or in part, and denied; the same received-complied-denied breakdown for requests to opt out of sale or sharing and requests to limit; the number of requests to opt out of automated decisionmaking technology, received, complied with in whole or in part, and denied; and the median or mean number of days the business took to substantively respond to requests to delete, correct, know, opt out of sale or sharing, and limit.

That is a genuinely granular disclosure, not a single aggregate request count. A business preparing for this duty needs its request-handling system to track outcome and timing by request type, in addition to overall volume.

When and where to disclose it

Section 7102(a)(2) sets the deadline: by July 1 of every calendar year, disclosed either within the business's privacy policy or posted on its website and accessible from a link included in the privacy policy. The business may choose, in that same disclosure, to break out how many requests it denied because they were not verifiable, not made by a consumer, called for information exempt from disclosure, or denied on other grounds. That additional breakdown is optional. The core eight metrics are not.

The all-individuals alternative

Section 7102(b) gives a business one piece of flexibility. It may choose to compile and disclose the required information for requests received from all individuals, rather than limiting the compilation to requests from consumers specifically, provided it states in its disclosure that it has done so. If the Attorney General later asks, the business must still be able to compile and provide the consumer-specific figures on request. This is a reporting convenience, not an exemption from the underlying duty.

Who this actually reaches

In practice, the ten-million-consumer threshold limits this duty to the largest platforms, retailers, and data brokers operating in California, not the typical business that clears the CCPA's general revenue or consumer-count thresholds. If your business is nowhere close to that volume, the metrics duty in Section 7102 is not something you need to build a system around. What you still owe, at the CCPA's ordinary thresholds, is timely handling of requests to know and requests to delete, which carry their own deadlines regardless of scale.

Next step

Scale thresholds like this one are exactly where a flat compliance checklist breaks down, because the duty that applies to you depends on a number specific to your business. The free 2-minute Obligation Scan checks which CCPA duties actually reach your business, metrics disclosure included, rather than assuming every rule in the regulations applies to every covered business equally.