Why California keeps landing on small business desks
California's privacy law was written with large companies in mind, and for a while it mostly stayed there. That is no longer a safe assumption. The way the thresholds are drafted, a business with a handful of staff can be squarely in scope while a much larger competitor sits outside it. The trigger is not just how much money you make. It is also how much data moves through your business and where it goes.
The law is the California Consumer Privacy Act, as amended by the California Privacy Rights Act — usually written as CCPA/CPRA and discussed as one set of rules. It is enforced by the California Privacy Protection Agency, which now brands itself publicly as CalPrivacy, and separately by the California Attorney General. Both can act. The agency did not take the Attorney General's job away.
If you sell online, run advertising, or keep a customer list, this is worth an hour of your attention — not because California is unusually harsh, but because it is the rule set most other US states have borrowed from, so getting it right tends to solve several problems at once.
Who this applies to
You are in scope if you do business in California, you decide the purposes and means of processing personal information — meaning you choose why the data is collected and how it is used, rather than acting on someone else's instructions — and you meet any one of three tests.
The first is revenue: annual gross revenue over $26,625,000 in the preceding calendar year. That figure is adjusted for inflation, which is why you will still see the older $25 million number quoted in a lot of blog posts. It is out of date.
The second is volume: you buy, sell, or share the personal information of 100,000 or more consumers or households.
The third is business model: you derive 50% or more of your annual revenue from selling or sharing personal information.
Those second and third tests are the ones that catch genuinely small businesses. "Sharing" here has a specific meaning: disclosing personal information for cross-context behavioural advertising, which is what most ad platform pixels do. A ten-person ecommerce brand running retargeting across a large audience can cross the 100,000 line without ever thinking of itself as a data company, while a local firm with $40 million in revenue and no online advertising may not be in scope at all. Work through all three tests before you conclude anything.
What the law actually asks of you
Give a notice at collection, at or before the point you collect. People are supposed to know what you are gathering and why at the moment it happens, not later when they go hunting through a policy. In practice that means a short, readable notice where the collection happens — on the signup form, at checkout, in the app onboarding — saying what categories you collect, what you use them for, and linking to the fuller privacy policy. A policy buried in the footer does not satisfy this on its own.
Publish a "Do Not Sell or Share My Personal Information" link. If you sell or share personal information as the law defines those terms, this link has to be there and it has to work. The wording matters because consumers are meant to recognise it across sites. Test it end to end — a surprising number open a page that describes the right without giving anyone a way to exercise it.
Add a "Limit the Use of My Sensitive Personal Information" link where it applies. Sensitive personal information is a defined category, and if you use it beyond the narrow purposes the law permits, consumers can tell you to stop. Many small businesses do not touch it at all, in which case the link is unnecessary — but check before deciding you are exempt, because the category is broader than the everyday meaning of "sensitive".
Honour Global Privacy Control signals. Global Privacy Control, or GPC, is a setting in some browsers and extensions that automatically signals a user's wish to opt out. California treats an opt-out preference signal as a valid opt-out request, so it carries the same weight as someone clicking your link. This is the obligation most often missed, because it is invisible — nothing on your site tells you it is failing. It usually needs configuration in your consent tool or tag manager, not just a checkbox.
Be ready to handle consumer rights requests. Consumers can ask to know what you hold, to delete it, to correct it, and to opt out of the sale or sharing of their data and of certain automated decision-making. The hard part is rarely legal. It is operational: knowing which systems hold a given customer's data, being able to retrieve or remove it, and having someone whose job it is to respond. Decide in advance who handles these and where the record of the response lives.
Put the required terms in your vendor contracts. If you pass personal information to an email platform, a fulfilment partner, an analytics tool, or a contractor, you need written contracts containing the terms the law specifies. Most large vendors publish a data processing addendum you can accept. Smaller suppliers often do not, and those are the gaps worth closing first.
Understand what enforcement costs. Administrative fines run to $2,663 per violation, rising to $7,988 for an intentional violation or one involving the personal information of a minor. These are the inflation-adjusted figures. Per-violation counting is what makes them sting, since one misconfigured form can affect a lot of people.
What changed for 2026
AB 45 In force1 January 2026 was signed on 26 September 2025 and took effect at the start of the year. It is a location law more than a health-records law. It makes it unlawful to collect, use, disclose, sell, share, or retain the personal information of anyone physically located at, or within a precise geolocation of, a family planning center, and it prohibits geofencing an entity that provides in-person health care services in California in order to identify or track people, collect their personal information, or send them notifications or advertising. Precise geolocation means a radius of 1,850 feet or less. Two things make it wider than it first sounds. It binds any person, not only a business over the CCPA thresholds, and it carries civil penalties of $25,000 per violation alongside a limited private right of action. If you buy location-based advertising, or your site or app collects precise location, read this one properly.
SB 361 (2025) amends the data broker registration rules under the Delete Act. Registered data brokers now have to disclose more about the categories of data they collect, including whether they share personal information with foreign actors or with developers of generative AI systems. Two points of precision. First, only businesses meeting the statutory definition of a data broker have to register — most small businesses do not, though a business that sells lists or audience data should check. Second, the 45-day duty to process deletion requests through the DROP mechanism comes from the Delete Act as amended, not from SB 361 standing alone. You will see that attributed incorrectly in a lot of summaries.
ADMT Not yet in forceobligations start 1 January 2027 is the 2026 change with a deadline still ahead of it rather than a date already passed. The CCPA regulations covering automated decisionmaking technology, risk assessments and cybersecurity audits were approved on 23 September 2025 and took effect on 1 January 2026, but the ADMT obligations themselves do not start until 1 January 2027. They bite where an automated technology makes a significant decision about someone, and significant decision is a defined and fairly narrow term: financial or lending services, housing, education, employment or independent contracting, and health care services. Advertising is expressly outside it. Where you are inside it, you owe a notice before you use the technology, a right to opt out, and an explanation of how the decision was reached if someone asks. Most small businesses are not inside it — but automated screening of job applicants is, and so is an automated decision on credit or a payment plan.
Alongside the legislation, the applicability thresholds and the fine amounts have been adjusted for inflation, and the agency's guidance now appears under the CalPrivacy name at privacy.ca.gov.
Common mistakes
The most common is stopping at the revenue test. An owner reads an out-of-date figure somewhere, knows they are nowhere near it, and closes the tab — missing the two other routes into scope.
The second is treating GPC as optional, or assuming a cookie banner covers it. A banner asks the visitor a question. GPC is the visitor answering before you ask. If your stack does not read the signal, the banner does not help.
The third is a copied privacy policy. Policies copied from another site describe that site's data practices, and the mismatch between what your policy says and what your tags actually do is exactly what an investigation looks for.
The fourth is assuming the Attorney General is out of the picture now that CalPrivacy exists. Both enforce.
The fifth is deciding location data is somebody else's problem because you are not a clinic. Under AB 45 it is the location that does the work, not your sector — an audience drawn around a map area can catch a health facility without anyone intending it.
Dxtra builds a privacy program for you from a questionnaire — a privacy policy, cookie notice, consent records, processing records, a public Transparency Center, and DSAR handling — mapped against more than 500 obligations across 140+ countries, starting at $10 a month. It will not replace a lawyer on a genuinely hard question, but for a small business trying to get the basics in place and keep them current, it is a reasonable place to start.
Where to start
Begin with the three thresholds and write down your answer for each, with the reasoning. That single page is what you will want if anyone ever asks.
Then look at what is actually running on your site. List the third-party tags and pixels, and for each decide whether it involves selling or sharing. That list drives most of the rest: whether you need the opt-out link, how GPC has to be wired up, and which vendors need contract terms.
For a quick view of what a visitor sees from the outside, Dxtra's free scan reads your site's public pages in about two minutes with no signup and returns a risk band with findings mapped to named sources, so you can check where each point comes from rather than taking it on trust. It is a starting point for your own review, not a determination that you are compliant.
Sources
Current as of 28 July 2026. Figures, fees and commencement dates move; check the linked source before you rely on any of them.
- CalPrivacy (California Privacy Protection Agency) — the agency's CalPrivacy branding and consumer guidance
- CPPA — Updated Monetary Thresholds in CCPA — the $26,625,000 gross revenue threshold
- California AG — California Consumer Privacy Act — the 100,000 consumer/household test and Global Privacy Control
- Cal. Civ. Code §1798.140 — CCPA definitions — "business" thresholds and the definition of sharing
- Cal. Civ. Code §1798.100 — notice at collection — notice at or before the point of collection
- CPPA — text of the CCPA as amended (§1798.135) — the two required opt-out link titles
- CPPA — 2025 CCPA fine and penalty increases — the $2,663 and $7,988 per-violation figures
- AB 45 (2025) — bill text, Chapter 134 — signing date and scope of the geofencing rules
- CalPrivacy — Information for Data Brokers — SB 361 disclosures, DROP and the 45-day deletion duty
- CPPA — California Finalizes Regulations to Strengthen Consumers' Privacy — approval on 23 September 2025 and ADMT compliance from 1 January 2027
This article is general information, not legal advice. Rules change; confirm anything that matters with the California Privacy Protection Agency (privacy.ca.gov) or a qualified adviser before you rely on it.