Does the CCPA apply to my small business? Thresholds, CalOPPA and GPC (2026)

The CCPA thresholds

The California Consumer Privacy Act (as amended by the CPRA) applies to for-profit businesses that do business in California and meet at least one test: annual gross revenue over $26,625,000 (the inflation-adjusted figure in effect from 1 January 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or making half or more of annual revenue from selling or sharing personal information (CPPA).

"Sharing" here means sharing personal information for cross-context behavioral advertising, which is what many ad pixels do. A high-traffic site with ad tags can reach the 100,000 test without high revenue.

Penalties

The same CPPA page sets administrative fines of up to $2,663 per violation, or $7,988 for intentional violations or those involving consumers under 16, and consumer damages of $107 to $799 per consumer per incident in data-breach cases (CPPA).

CalOPPA: a privacy policy even for small sites

California's Online Privacy Protection Act requires the operator of a commercial website that collects personally identifiable information from California residents to post a privacy policy. It must say what is collected, who it is shared with, and how the site responds to "Do Not Track" signals (Cal. Bus. & Prof. Code §22575). There is no revenue threshold.

Global Privacy Control

Businesses covered by the CCPA must treat opt-out preference signals, such as Global Privacy Control (GPC), as a valid request to opt out of sale or sharing (California AG; CPPA regulations; GPC). Several other states with comprehensive privacy laws, including Colorado, Connecticut, Oregon and Texas, also require universal opt-out signals to be honoured.

Other states

A growing number of states have comprehensive privacy laws, each with its own thresholds. Indiana, Kentucky and Rhode Island's laws took effect on 1 January 2026. The IAPP keeps a free tracker (IAPP).

Quick checklist

You have a privacy policy linked from every page
It says what you collect, why, and who you share it with
It includes a Do Not Track / GPC statement
You know whether any ad pixels "share" data for cross-context advertising
If the CCPA applies, you have a "Do Not Sell or Share" or "Your Privacy Choices" link
Your ad tags stop when a browser sends GPC (if you are covered)

FAQ

I’m under $26.6 million revenue. Am I safe?

Not necessarily: the 100,000-consumer test and the 50%-of-revenue test are separate, and CalOPPA applies regardless of size. Other states have their own thresholds.

Do I need a cookie banner in the US?

US state laws are mostly opt-out rather than opt-in for advertising cookies, so a banner isn’t generally required, but you must give covered consumers a way to opt out and honour GPC where required. EU and UK visitors are a different matter.

Is this legal advice?

No. It summarises official sources. Talk to a US-licensed attorney about your own situation.

Official sources

Laws and guidance change. Check the sources above for the latest position. General information, not legal advice. For advice on your own situation, talk to a US-licensed attorney.