Does the CCPA apply if my business makes under $25 million?

Two things are usually wrong when a founder tells me the CCPA does not apply because the company is under $25 million. The number is out of date, and revenue was never the only way in.

The threshold is $26,625,000

Cal. Civ. Code section 1798.140(d)(1)(A) covers a business that, as of January 1 of the calendar year, "had annual gross revenues in excess of twenty-five million dollars ($25,000,000)... in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95."

That last clause is the part people skip. Section 1798.199.95(d) makes the California Privacy Protection Agency adjust the CCPA's monetary thresholds for inflation every odd-numbered year. Effective January 1, 2025, the Agency published the adjusted figure: $26,625,000. The printed statute still shows $25,000,000 with a footnote pointing at the updated amount, which is exactly why the stale number keeps circulating.

The same adjustment moved the statutory damages range in section 1798.150(a)(1)(A) to between $107 and $799 per consumer per incident, and the fine and penalty figures in sections 1798.155(a) and 1798.199.90(a) to $2,663 per violation and $7,988 per intentional violation.

Revenue is one of three doors, not the door

Section 1798.140(d)(1) applies to a for-profit entity that collects California consumers' personal information, alone or jointly determines the purposes and means of processing it, does business in California, and "satisfies one or more of the following thresholds." One or more. The three are:

• (A) annual gross revenues over $26,625,000 in the preceding calendar year;
• (B) alone or in combination, annually buying, selling, or sharing the personal information of 100,000 or more consumers or households;
• (C) deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information.

A twelve-person adtech company with $4 million in revenue can fail (B) and (C) comfortably. A consumer app with a large free user base and advertising tags can hit (B) without ever noticing, because "sharing" under the CCPA includes disclosing personal information for cross-context behavioral advertising, not just selling it for money.

The two routes that catch people by surprise

Even a business that clears all three thresholds can be covered by association. Section 1798.140(d)(2) covers an entity that controls or is controlled by a business under paragraph (1), shares common branding with it, and shares consumers' personal information with it. Control means owning or having the power to vote more than 50 percent of voting securities, controlling the election of a majority of directors, or having controlling influence over management. Common branding means a shared name, servicemark, or trademark that an average consumer would read as common ownership.

Section 1798.140(d)(3) does something similar for joint ventures and partnerships where each business holds at least a 40 percent interest: the venture and each constituent business are each treated as a single business.

There is also a voluntary route in section 1798.140(d)(4), for a business not otherwise covered that certifies to the California Privacy Protection Agency that it complies and agrees to be bound.

Answering the question properly

If you want a defensible answer rather than a guess, run all three thresholds, then check the affiliate and joint venture provisions, then look at the exemptions that may carve out particular data even where the entity is covered. Being based outside California does not help on its own, as the out-of-state applicability question sets out, and other states run different thresholds entirely.

The cost of getting it wrong is not abstract. CCPA fines are assessed per violation, and violations are generally counted per consumer.