CCPA Compliance for Small Businesses in 2026: Does It Apply to You?

The California Consumer Privacy Act (CCPA), as amended and strengthened by the California Privacy Rights Act (CPRA), is now the most comprehensive consumer data privacy law in the United States — and it applies to far more small businesses than most owners realize. Unlike GDPR, which applies based on where your users are, CCPA applies based on specific business thresholds. If you meet any one of three criteria, you must comply — regardless of whether you're based in California.

CCPA penalties in 2026: $2,500 per unintentional violation; $7,500 per intentional violation. California's Attorney General actively enforces CCPA and has issued enforcement actions against businesses ranging from small e-commerce companies to major corporations. A single campaign involving thousands of California consumers can create substantial exposure.

Does CCPA apply to your business?

CCPA applies to for-profit businesses that do business in California AND meet at least one of these thresholds:

Threshold	Applies To Your Business?	What It Means
Annual gross revenue exceeds $25 million	Any business generating $25M+ annually	If yes — CCPA applies regardless of California footprint
Buys, sells, or shares personal information of 100,000+ California consumers or households annually	Any business with large California user base	E-commerce, SaaS, and content businesses often hit this
Derives 50%+ of annual revenue from selling personal information	Data brokers and ad-supported businesses	Less common for typical small businesses

The 100,000 consumer threshold is the one that catches most mid-sized e-commerce, SaaS, and content businesses. If your website attracts significant California traffic and you collect personal information (including cookies and identifiers), you may meet this threshold even without realizing it.

Calculating your California consumer count: Include every California resident whose personal data you process — website visitors whose cookies you collect, email subscribers, customers, and even B2B contact records where the individual is a California resident. Google Analytics data shows your California visitor count; multiply by conversion rates to estimate your total consumer count.

What CCPA/CPRA requires

1. Transparency — tell consumers what you collect and why

Your privacy policy must disclose:

Categories of personal information collected (identifiers, commercial info, internet activity, geolocation, etc.)
Business or commercial purpose for which each category is collected
Categories of third parties with whom information is shared
Retention period for each category
Whether each category is sold or shared with third parties

2. Consumer rights — respond to requests

Right	What It Requires	Response Deadline
Right to know	Provide a copy of personal information collected about the consumer	45 days (one 45-day extension permitted)
Right to delete	Delete personal information upon request (with exceptions)	45 days
Right to correct	Correct inaccurate personal information	45 days
Right to opt-out of sale/sharing	Stop selling or sharing the consumer's data with third parties	Process immediately; confirm within 15 days
Right to limit use of sensitive data	Limit use and disclosure of sensitive personal information	Honor immediately
Right of non-discrimination	Cannot deny service or charge different prices for exercising rights	Ongoing compliance

3. Opt-out mechanism — 'Do Not Sell or Share My Personal Information'

If you sell or share personal information with third parties (including sharing with advertising platforms like Google and Meta for ad targeting), you must:

Post a clearly visible 'Do Not Sell or Share My Personal Information' link on your homepage and privacy policy
Honor opt-out requests immediately — stop selling or sharing within 15 business days
Implement Global Privacy Control (GPC) signals — browsers that send GPC signals must be treated as opt-out requests automatically

4. Sensitive personal information protections

CPRA added special protections for sensitive categories: Social Security numbers, financial account information, precise geolocation, racial/ethnic origin, religious beliefs, union membership, genetic data, health information, and sexual orientation. Sensitive information requires explicit opt-in consent before use for anything beyond specified purposes.

CCPA vs GDPR: the key differences

Feature	CCPA/CPRA	GDPR
Geographic trigger	Business thresholds (revenue, data volume)	Where your users are located
Applies to	For-profit businesses meeting thresholds	Any org processing EU resident data
Consent model	Opt-out (default processing allowed)	Opt-in for most processing
Right to know	Yes	Yes
Right to delete	Yes	Yes (right to erasure)
Right to portability	Yes	Yes
Cookie consent required	No (but GPC compliance required)	Yes — opt-in before non-essential cookies
Penalties	$2,500–$7,500 per violation	4% global revenue or 20M euros
Enforcement	California AG + California Privacy Protection Agency	EU supervisory authorities

Practical CCPA compliance checklist

Determine if you meet the thresholds — check revenue, consumer count, and data monetization criteria
Audit your data collection — list every category of personal information you collect and the business purpose
Update your privacy policy — add all required CCPA disclosures; include a 'Last Updated' date
Add 'Do Not Sell or Share' link — visible on homepage and footer if you sell or share data with third parties
Create a consumer rights request process — email address or web form; document your 45-day response procedure
Implement GPC signal recognition — update your website or cookie consent tool to honor GPC signals
Review advertising practices — if you run Google or Meta ads using your customer data for targeting, this is likely 'sharing' under CCPA
Update vendor agreements — add data processing addendums with vendors who access your California consumers' data (see our guide to essential business contracts)
Train staff — anyone who handles consumer data requests needs to understand the process

The advertising data question most businesses miss

The most underappreciated CCPA compliance issue for small businesses: sharing customer data with advertising platforms constitutes 'sharing' personal information under CCPA — even if you're not receiving money directly for the data.

When you install the Meta Pixel or Google Ads tag on your website, you're sharing behavioral data about California visitors with Meta or Google for advertising purposes. Under CCPA, this is 'sharing' personal information that triggers the opt-out requirement. If you haven't addressed this in your privacy policy and provided an opt-out mechanism, you may be non-compliant even without any traditional 'data sale.'

Practical fix: update your privacy policy to disclose this sharing, provide a 'Do Not Sell or Share' link, implement a cookie consent tool that honors opt-out for advertising pixels, and configure your advertising pixel settings to respect user opt-outs (both Google and Meta provide consent mode settings for this).

Frequently asked questions

Does CCPA apply to B2B data?

Post-CPRA (2023), the exemption for B2B contact data expired. Personal information of individuals acting in their professional capacity (business email addresses, job titles, work contact information) is now covered by CCPA. If you collect and process B2B contact data about California residents, CCPA rights apply to that data.

What if I don't sell personal data — do I still need to comply?

CCPA applies to any covered business regardless of whether you sell data. The 'Do Not Sell or Share' requirement applies to sharing with third parties for cross-context behavioral advertising — which includes ad pixels — not just traditional data sales. The right to know, delete, correct, and portability apply to all covered businesses.

Can small businesses get fined even without a complaint?

Yes — the California Privacy Protection Agency (CPPA) can investigate businesses proactively and issue enforcement actions without a consumer complaint. The Attorney General also conducts audits. Businesses that clearly meet the thresholds and clearly lack a compliant privacy policy are the most exposed. For complex situations, this is a good case for hiring a business lawyer.

Bottom line

CCPA compliance for a business that meets the thresholds is not optional — and the 100,000 consumer threshold reaches further into small business territory than most owners realize. The good news: basic compliance is achievable with an updated privacy policy, an opt-out mechanism, a consumer rights request process, and cookie consent configuration — most of which can be implemented in a few days without legal counsel.

Start with the threshold analysis. If you meet even one criterion, prioritize compliance this quarter. Add CCPA reviews to your annual compliance checklist, and make sure your business insurance includes cyber liability coverage. The cost of a single enforcement action far exceeds the cost of implementing basic compliance.

American Business Center provides trusted, plain-English guides, reviews, and tools for U.S. small and mid-sized business owners. This article is for informational purposes only and does not constitute legal, financial, or tax advice. See our affiliate disclosure.