Why California keeps landing on small business desks
California's privacy law was written with large companies in mind, and for a while it mostly stayed there. That is no longer a safe assumption. The way the thresholds are drafted, a business with a handful of staff can be squarely in scope while a much larger competitor sits outside it. The trigger is not just how much money you make. It is also how much data moves through your business and where it goes.
The law is the California Consumer Privacy Act, as amended by the California Privacy Rights Act — usually written as CCPA/CPRA and discussed as one set of rules. It is enforced by the California Privacy Protection Agency, which now brands itself publicly as CalPrivacy, and separately by the California Attorney General. Both can act. The agency did not take the Attorney General's job away.
If you sell online, run advertising, or keep a customer list, this is worth an hour of your attention — not because California is unusually harsh, but because it is the rule set most other US states have borrowed from, so getting it right tends to solve several problems at once.
Who this applies to
You are in scope if you do business in California, you decide the purposes and means of processing personal information — meaning you choose why the data is collected and how it is used, rather than acting on someone else's instructions — and you meet any one of three tests.
The first is revenue: annual gross revenue over $26,625,000 in the preceding calendar year. That figure is adjusted for inflation, which is why you will still see the older $25 million number quoted in a lot of blog posts. It is out of date.
The second is volume: you buy, sell, or share the personal information of 100,000 or more consumers or households.
The third is business model: you derive 50% or more of your annual revenue from selling or sharing personal information.
Those second and third tests are the ones that catch genuinely small businesses. "Sharing" here has a specific meaning: disclosing personal information for cross-context behavioural advertising, which is what most ad platform pixels do. A ten-person ecommerce brand running retargeting across a large audience can cross the 100,000 line without ever thinking of itself as a data company, while a local firm with $40 million in revenue and no online advertising may not be in scope at all. Work through all three tests before you conclude anything.
What the law actually asks of you
Give a notice at collection, at or before the point you collect. People are supposed to know what you are gathering and why at the moment it happens, not later when they go hunting through a policy. In practice that means a short, readable notice where the collection happens — on the signup form, at checkout, in the app onboarding — saying what categories you collect, what you use them for, and linking to the fuller privacy policy. A policy buried in the footer does not satisfy this on its own.
Publish a "Do Not Sell or Share My Personal Information" link. If you sell or share personal information as the law defines those terms, this link has to be there and it has to work. The wording matters because consumers are meant to recognise it across sites. Test it end to end — a surprising number open a page that describes the right without giving anyone a way to exercise it.
Add a "Limit the Use of My Sensitive Personal Information" link where it applies. Sensitive personal information is a defined category, and if you use it beyond the narrow purposes the law permits, consumers can tell you to stop. Many small businesses do not touch it at all, in which case the link is unnecessary — but check before deciding you are exempt, because the category is broader than the everyday meaning of "sensitive".
Honour Global Privacy Control signals. Global Privacy Control, or GPC, is a setting in some browsers and extensions that automatically signals a user's wish to opt out. California treats an opt-out preference signal as a valid opt-out request, so it carries the same weight as someone clicking your link. This is the obligation most often missed, because it is invisible — nothing on your site tells you it is failing. It usually needs configuration in your consent tool or tag manager, not just a checkbox.
Be ready to handle consumer rights requests. Consumers can ask to know what you hold, to delete it, to correct it, and to opt out of the sale or sharing of their data and of certain automated decision-making. The hard part is rarely legal. It is operational: knowing which systems hold a given customer's data, being able to retrieve or remove it, and having someone whose job it is to respond. Decide in advance who handles these and where the record of the response lives.
Put the required terms in your vendor contracts. If you pass personal information to an email platform, a fulfilment partner, an analytics tool, or a contractor, you need written contracts containing the terms the law specifies. Most large vendors publish a data processing addendum you can accept. Smaller suppliers often do not, and those are the gaps worth closing first.
Understand what enforcement costs. Administrative fines run to $2,663 per violation, rising to $7,988 for an intentional violation or one involving the personal information of a minor. These are the inflation-adjusted figures. Per-violation counting is what makes them sting, since one misconfigured form can affect a lot of people.
What changed for 2026
AB 45 was signed on 26 September 2025 and took effect on 1 January 2026. It restricts the collection, sale, sharing, and use of consumer health data, and it prohibits geofencing around family planning and other health-care facilities for the purpose of targeting advertising. The term "consumer health data" is wider than most people assume. It is not limited to medical records, and it can reach wellness, fitness, and fertility-adjacent businesses that have never thought of themselves as healthcare. If you run a gym, a supplements shop, or a mental wellbeing service, read this one properly.
SB 361 (2025) amends the data broker registration rules under the Delete Act. Registered data brokers now have to disclose more about the categories of data they collect, including whether they share personal information with foreign actors or with developers of generative AI systems. Two points of precision. First, only businesses meeting the statutory definition of a data broker have to register — most small businesses do not, though a business that sells lists or audience data should check. Second, the 45-day duty to process deletion requests through the DROP mechanism comes from the Delete Act as amended, not from SB 361 standing alone. You will see that attributed incorrectly in a lot of summaries.
Alongside the legislation, the applicability thresholds and the fine amounts have been adjusted for inflation, and the agency's guidance now appears under the CalPrivacy name at privacy.ca.gov.
Common mistakes
The most common is stopping at the revenue test. An owner reads an out-of-date figure somewhere, knows they are nowhere near it, and closes the tab — missing the two other routes into scope.
The second is treating GPC as optional, or assuming a cookie banner covers it. A banner asks the visitor a question. GPC is the visitor answering before you ask. If your stack does not read the signal, the banner does not help.
The third is a copied privacy policy. Policies copied from another site describe that site's data practices, and the mismatch between what your policy says and what your tags actually do is exactly what an investigation looks for.
The fourth is assuming the Attorney General is out of the picture now that CalPrivacy exists. Both enforce.
The fifth is deciding you have no sensitive or health data because you are not a clinic. Under AB 45's definition, that reasoning does not hold for a lot of ordinary businesses.
Dxtra builds a privacy program for you from a questionnaire — a privacy policy, cookie notice, consent records, processing records, a public Transparency Center, and DSAR handling — mapped against more than 500 obligations across 140+ countries, starting at $10 a month. It will not replace a lawyer on a genuinely hard question, but for a small business trying to get the basics in place and keep them current, it is a reasonable place to start.
Where to start
Begin with the three thresholds and write down your answer for each, with the reasoning. That single page is what you will want if anyone ever asks.
Then look at what is actually running on your site. List the third-party tags and pixels, and for each decide whether it involves selling or sharing. That list drives most of the rest: whether you need the opt-out link, how GPC has to be wired up, and which vendors need contract terms.
For a quick view of what a visitor sees from the outside, Dxtra's free scan reads your site's public pages in about two minutes with no signup and returns a risk band with findings mapped to named sources, so you can check where each point comes from rather than taking it on trust. It is a starting point for your own review, not a determination that you are compliant.
This article is general information, not legal advice. Rules change; confirm anything that matters with the California Privacy Protection Agency (privacy.ca.gov) or a qualified adviser before you rely on it.