California
For California, law name and abbreviation is California Consumer Privacy Act of 2018 / California Privacy Rights Act (CCPA/CPRA); effective date is January 1, 2020 (CCPA); January 1, 2023 (CPRA amendments); consumer volume threshold is annually buys, sells, or shares the personal information of 100,000 or more consumers or households; revenue-from-data-sales threshold is Derives 50 percent or more of its annual revenues from selling or sharing consumers' personal information; revenue floor is annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to subdivision (d) of Section 1798.199.95, recorded from its source on 2026-08-12.
- State
- California our reading
- Law name and abbreviation
- California Consumer Privacy Act of 2018 / California Privacy Rights Act (CCPA/CPRA)
- Effective date
- January 1, 2020 (CCPA); January 1, 2023 (CPRA amendments)
- Consumer volume threshold
- annually buys, sells, or shares the personal information of 100,000 or more consumers or households verified
- Revenue-from-data-sales threshold
- Derives 50 percent or more of its annual revenues from selling or sharing consumers' personal information
- Revenue floor
- annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to subdivision (d) of Section 1798.199.95 verified
- Threshold combination logic
- OR — satisfies one or more of the following thresholds verified
- Key exemptions
- Nonprofits; government agencies; HIPAA-covered entities; GLBA-regulated financial institutions; FCRA consumer reporting agencies; entities complying with Driver's Privacy Protection Act
- Enforcement mechanism
- State Attorney General and California Privacy Protection Agency (CPPA); limited private right of action for data breaches under Cal. Civ. Code § 1798.150
- Statute citation
- Cal. Civ. Code §§ 1798.100–1798.199.100
- Notes
- California is the only state with a standalone revenue threshold (no consumer volume required). The $25M threshold is inflation-adjusted annually per subdivision (d) of Section 1798.199.95. Definition of 'sale' is broad: includes renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information for monetary or other valuable consideration. CPRA added 'sharing' as a separate trigger covering cross-context behavioral advertising.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
California, and that satisfies one or more of the following thresholds: (A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.
— leginfo.legislature.ca.gov, retrieved 2026-08-12
Source
- leginfo.legislature.ca.govhttps://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV