A business must comply with the CCPA/CPRA if it can answer "yes" to any of the following questions:

  1. Does it raise annual gross revenues of at least $25 million per year?
  2. Does it buy, sell, receive for commercial purposes, and/or share for commercial purposes personal information from at least 50,000 California consumers, households, and/or devices?
  3. Does it earn at least half of its annual gross revenues per year from selling California consumers' personal information?