Does the California privacy law apply to my business?

Online retailer, Online service, SME

For-profit businesses doing business in California that meet a revenue threshold, buy, sell or share personal information of 100,000 or more consumers or households, or derive 50 percent or more of revenue from selling or sharing it.

If one threshold is met, consumers' rights to know, delete, correct and opt out must be honoured.

Provide a privacy notice, at least two request methods and a 'Do Not Sell or Share' link where applicable.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Check the three thresholds
2. Publish the privacy notice
3. Set up request channels
4. Answer verified requests

Respond to a verifiable consumer request within 45 days, extendable once by 45 days with notice.

• Cal. Civ. Code 1798.140(d)
• Cal. Civ. Code 1798.130(a)(2)

sha256 760886e3b35050f087d5558113e4ab924a8447349ae138f43a9e8829f6ea08da · read 2026-10-15 · Source: NovaCopilot

• What counts as selling or sharing under the CCPA?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?
• Does my small company need a GDPR processing register?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)
• agent:us:business:privacy-opt-out (business_agent)