Is the threshold still $25 million?

The statute still prints $25,000,000 in § 1798.140(d)(1)(A). Civil Code § 1798.199.95(d) requires the CPPA to adjust monetary amounts every odd-numbered year for inflation. The CPPA published $26,625,000 effective 1 January 2025 (posted 17 December 2024). This checker uses $26,625,000. The next adjustment is due in 2027.

Does this tool produce a binding determination?

No. It applies the statutory definition to your answers and returns a structured assessment. Counsel still decides. An organization can be a business for one product and a service provider for another.

We are a US company with no California office. Can CCPA still apply?

Yes. Doing business in California is about the market, not the lease. If you collect personal information of California residents and you meet a threshold, the definition can attach without a California entity.

We are a HIPAA covered entity. Are we done?

No. The HIPAA exemption is for PHI maintained as required by HIPAA. A clinic's marketing list, employee data after the old HR carve-out sunset, or a consumer app sitting next to the EHR can still be CCPA personal information.

What about Virginia, Colorado, Connecticut, and the other state laws?

This checker is California only. Those other state laws have their own thresholds and definitions. They often rhyme with CCPA but they are not the same statute. If you sell nationally, assess each one.

Does ISMS Copilot replace a privacy counsel review?

No. It drafts notices, workflows, and the applicability analysis. It does not issue a legal opinion and it does not file anything with the CPPA.

Free tool

CCPA / CPRA applicability checker

Answer six questions to see whether your organization is likely a "business" under the California Consumer Privacy Act (as amended by the CPRA), a service provider or contractor, or outside that definition. The answer turns on Cal. Civ. Code § 1798.140: for-profit, California personal information, doing business in California, deciding purposes and means, and at least one of the three thresholds (including the $26.625 million revenue figure in force since 1 January 2025). A structured assessment, not legal advice.

Based on Cal. Civ. Code §§ 1798.140, 1798.145, and 1798.199.95(d), and the CPPA inflation adjustment posted 17 December 2024.

What being a CCPA business means

If you are a "business" under Cal. Civ. Code § 1798.140(d), these are the core duties the CCPA / CPRA imposes. The checker above applies that definition, the service-provider path, and the per-dataset exemptions to indicate which category you fall into.

•Provide a notice at collection that names the categories of personal information and sensitive personal information, the purposes, whether you sell or share, and the retention period (Cal. Civ. Code § 1798.100, § 1798.130).
•Honor consumer requests to know, delete, and correct, and to opt out of sale or sharing, within the statutory timelines (§ 1798.105, § 1798.106, § 1798.110, § 1798.115, § 1798.120).
•If you sell or share personal information, offer a "Do Not Sell or Share My Personal Information" link or equivalent and honor opt-out preference signals (§ 1798.135).
•Limit use and disclosure of sensitive personal information when the consumer directs you to (§ 1798.121).
•Put a qualifying written contract in place before a service provider or contractor processes personal information on your behalf (§ 1798.100(d)).
•Implement reasonable security procedures and practices appropriate to the nature of the information (§ 1798.150(a)(1)).
•Enter into the California privacy regime's administrative requirements: a privacy policy that is updated at least every 12 months, methods to submit requests, and training for people who handle requests (§ 1798.130).

Primary sources

Jurisdiction: California, United States. Instrument: California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code §§ 1798.100–1798.199.95, as in force on the dates below. Other US state privacy laws (Virginia, Colorado, Connecticut, and the rest) are not assessed here.

Cal. Civ. Code § 1798.140, definitions including "business", "service provider", "contractor", "sell", and "share" (California Legislative Information, current) (Last verified 2026-08-13)
Cal. Civ. Code § 1798.145, construction and exemptions (HIPAA, GLBA, FCRA and others) (Last verified 2026-08-13)
California Privacy Protection Agency, Updated Monetary Thresholds in the CCPA (CPI adjustment to $26,625,000, effective 1 January 2025, posted 17 December 2024) (Last verified 2026-08-13)

Frequently asked questions

Is the threshold still $25 million?: The statute still prints $25,000,000 in § 1798.140(d)(1)(A). Civil Code § 1798.199.95(d) requires the CPPA to adjust monetary amounts every odd-numbered year for inflation. The CPPA published $26,625,000 effective 1 January 2025 (posted 17 December 2024). This checker uses $26,625,000. The next adjustment is due in 2027.
Does this tool produce a binding determination?: No. It applies the statutory definition to your answers and returns a structured assessment. Counsel still decides. An organization can be a business for one product and a service provider for another.
We are a US company with no California office. Can CCPA still apply?: Yes. Doing business in California is about the market, not the lease. If you collect personal information of California residents and you meet a threshold, the definition can attach without a California entity.
We are a HIPAA covered entity. Are we done?: No. The HIPAA exemption is for PHI maintained as required by HIPAA. A clinic's marketing list, employee data after the old HR carve-out sunset, or a consumer app sitting next to the EHR can still be CCPA personal information.
What about Virginia, Colorado, Connecticut, and the other state laws?: This checker is California only. Those other state laws have their own thresholds and definitions. They often rhyme with CCPA but they are not the same statute. If you sell nationally, assess each one.
Does ISMS Copilot replace a privacy counsel review?: No. It drafts notices, workflows, and the applicability analysis. It does not issue a legal opinion and it does not file anything with the CPPA.

By ISMS Copilot. Based on Cal. Civ. Code §§ 1798.140, 1798.145, and 1798.199.95(d), and the CPPA inflation adjustment posted 17 December 2024.

Browse all 21 free compliance tools

Ready to do compliance work faster?

Built for speed, accuracy, and audit-ready output.

Try ISMS Copilot