Does California's privacy law (CCPA) apply to your business?
Five questions, two minutes. Most small businesses are outside the CCPA — and this check is allowed to say so. If it does apply, two more questions tell you whether California's new cybersecurity-audit rule does too, and when. Runs in your browser; nothing you answer is sent or stored.
Figures valid through December 31, 2026 (California adjusts them every two years; next on January 1, 2027). Last checked October 6, 2026. Not legal advice.
1Do you do business in California — sell to, serve, or collect information from people who live there?
You don't need an office there. An online store that ships to California customers usually counts.
2Is your business run for profit?
The CCPA covers for-profit businesses. Most nonprofits are outside it, unless a covered business controls them and they share its branding.
3Was your annual gross revenue over $26,625,000 in the last calendar year?
Total revenue from everywhere, not just California.
4Each year, do you buy, sell or share the personal information of 100,000 or more California consumers or households?
"Sharing" includes letting ad-tracking pixels (Meta, Google Ads, TikTok) follow your website's visitors for cross-site advertising. Every California visitor they track counts — a busy online store can pass 100,000 without selling anything.
5Do you make half or more of your annual revenue from selling or sharing personal information?
Data brokers, lead-generation businesses and some ad-funded sites. Most businesses can answer no.
Answer all five to see where you stand.
A free scope check to help you work out where you stand — not legal advice. The CCPA's definitions have details this page can't capture (what counts as "doing business", "selling" or "sharing", common-branding affiliates). If the answer matters to a decision, confirm it with a lawyer.