When US state privacy laws such as the CCPA apply to a small business.

The short answer

California's privacy law, the CCPA, applies to a business only if it crosses at least one of three lines. A plumber in San Diego with a few hundred customers a year crosses none of them. An online shop with modest sales but an advertising pixel on a site that many Californians visit might cross one without noticing, because passing data to an ad platform counts.

Below the lines, privacy rules do not disappear. California's older law, CalOPPA, still requires a privacy policy on a commercial website that collects personal details from Californians, and the FTC Act's ban on deceptive practices covers privacy promises a business does not keep. Whatever your size, what your privacy notice says has to be true.

Other states have passed privacy laws of their own, with their own thresholds. The check works the same way for each: find its thresholds, then compare them with your own numbers.

Check it in five questions

California's privacy agency, the CPPA, publishes a one-page check. In plain words, you are likely to be covered if you answer yes to all five:

• Are you a for-profit business: a sole trader, a partnership, a company or similar? A nonprofit is outside it, unless a covered business controls it and they share branding.
• Do you collect personal information from people who live in California, even if it is only names and email addresses from a contact form?
• Do you do business in California? The law asks this, not where you are based, so a business in another state that sells to Californians should not assume it is out.
• Do you decide why and how that information is used? If you only handle it for another business under a contract, other rules apply to you.
• Do you cross at least one of the three thresholds below?

A no to any of them means the CCPA itself does not apply, though the rules in the section on what applies below the lines still do. The CPPA's check also reminds readers that the law has exemptions, for example for information already handled under HIPAA, and says to consult an attorney about whether one fits your case.

Threshold one: gross revenue

The first line is annual gross revenue above 26,625,000 dollars in the previous calendar year. That is the figure the CPPA set from 1 January 2025. The law adjusts it for inflation every odd-numbered year, so look at the CPPA's page on its monetary thresholds each January of an odd year rather than relying on a figure in an old article.

It counts gross revenue, not profit, and the statute does not say that only sales in California count. Very few small businesses are anywhere near it, which is why the second threshold is the one that catches them.

Threshold two: 100,000 people, and the ad pixel

The second line is buying, selling or sharing the personal information of 100,000 or more California consumers or households in a year, alone or with others. Two definitions in the law make this easier to reach than it sounds:

• Personal information includes online identifiers and IP addresses as well as names and email addresses. A pixel that sends an ad platform a visitor's browser identifier and the pages they viewed is sending personal information.
• Sharing means passing personal information to a third party for cross-context behavioural advertising, whether or not any money changes hands. That is advertising aimed at someone because of what they did on other businesses' sites and apps, which is the job ad pixels feed.

California's Attorney General has already treated tracking this way. In its August 2022 settlement with Sephora, the Attorney General said the company's arrangement with third-party trackers on its website and app was a sale of consumer information, which Sephora had neither disclosed nor let people opt out of.

So a small business with a Meta pixel or a Google Ads remarketing tag, and a lot of visitors from California, should count. Look at your analytics for visitors by state over the last calendar year. A visitor is not a person, because one person can visit on a phone and a laptop and one household can hold several people, so treat the number as a rough guide, and ask an adviser if you are anywhere near the line.

If you are near it, there are three ways forward: stop sending data from your site to ad platforms, send less of it, or accept that you are covered and do what the law asks. Each one changes what your ads can measure, so decide it together with whoever runs your ads. A landing page for ads that carries the campaign tags into each enquiry still shows which ads bring work when the pixel sends less.

Find out what your site sends to ad platforms

Before you count anyone, find out whether the second threshold is even in play. Most owners do not know every tag on their own site, because agencies, plugins and booking tools add them. Make the list:

• Open the site in a private window with the browser's developer tools on the Network tab, and note every request to an advertising company, such as Meta, Google's ad servers, TikTok or Microsoft.
• Ask whoever runs your ads whether they build audiences from your site's visitors, such as remarketing lists or custom audiences. That is the use the law calls cross-context behavioural advertising.
• Check your booking tool, store platform and chat widget for marketing tags of their own, which run on your pages whether or not you added them.
• Write down what each tag receives: page views, button taps, purchases or email addresses.

The list does two jobs. It tells you whether the pixel question applies to you at all, and it is what your privacy notice has to describe, whether or not you are covered.

Threshold three: revenue from selling data

The third line is earning half or more of your annual revenue from selling or sharing consumers' personal information. A business that sells its own service or products never comes near it.

A business that sells leads can. A site that collects home improvement enquiries and passes each one to contractors for a fee earns its money from personal information, and whether that counts as selling depends on how the enquiry is passed on and what the person asked for. That is a question for an adviser before the site launches, not after.

Other states draw other lines

California is not alone. Other states have passed broad privacy laws, and their thresholds differ. Virginia's law, for example, applies to businesses that operate in Virginia or target its residents and, in a calendar year, control or process the personal data of at least 100,000 Virginia consumers, or of at least 25,000 and earn over half their gross revenue from selling personal data. It has no revenue threshold at all.

So the same business can be inside one state's law and outside another's. If you sell across the US, list the states where you have the most customers, look up each one's thresholds on its attorney general's website, and note the date you checked, because the lines can change. A local business that serves one town will usually be under all of them, since they are measured in tens of thousands of residents.

What still applies below the lines

Being under every threshold does not mean anything goes. These apply whatever your size:

• California's CalOPPA requires a conspicuously posted privacy policy on a commercial website that collects personally identifiable information from Californians, such as a name and email address sent through a contact form. What a privacy policy needs covers it in full.
• The FTC Act bans deceptive practices. A privacy policy that says you never share data, on a site that runs an ad pixel, makes a promise the site is breaking.
• Your ad platforms' own terms. Meta's Business Tools Terms, for example, require clear notice on every page where its pixel runs.
• If customer data is ever stolen, state breach notification laws decide whom you must tell. They are separate laws with their own tests, so ask your adviser at the time.
• A clinic also has HIPAA, which has nothing to do with these thresholds.

For a business in this position, the useful work is small: an honest notice, written from what the site really collects, and a check of every tag and widget against it.

If you are covered, what it brings

A covered business takes on a set of duties under the CCPA. In outline:

• A notice at or before the point where you collect personal information, saying what you collect and why.
• A privacy policy with the content the law lists, updated at least once every 12 months.
• A way for people to ask what you hold about them, to have it deleted or corrected, and to opt out of its sale or sharing. Requests to know, delete or correct must be answered within 45 days of receiving a verifiable request.
• In most cases, a clear link such as Do Not Sell or Share My Personal Information, if you sell or share.
• Treating opt-out preference signals, such as a browser's Global Privacy Control, as a valid request to opt out.
• Written contracts with the companies that handle personal information for you.
• The same rights for your employees, job applicants and business contacts who live in California. The exemptions for that information expired on 31 December 2022.

Expect a project with several steps. If the thresholds catch you, work with an adviser who knows the CCPA, and give them a list of every tool your site and team use and what each one receives.

Four businesses, checked

• A two-van plumbing firm in Sacramento. Revenue far below the first line, a few thousand customers on its books, no ad pixel. Not covered. It still needs an honest privacy policy under CalOPPA.
• A group of three salons in Los Angeles that runs Meta ads with the pixel on its booking pages. Revenue below the first line. It needs a rough count of how many Californians' data the pixel sends to Meta each year, and if that is anywhere near 100,000, it talks to an adviser.
• An online store in Oregon that sells across the US, with Google and Meta tags on every page and many visitors from California. The second line is the one to watch, and so are the laws of the other states it sells into.
• A law firm in San Francisco with a contact form and no ads. Not covered on these numbers, though its professional duty of confidentiality covers every enquiry anyway.

How our own site handles it

We set up ggsites.com so the second threshold has nothing to count. The site counts visits with its own code, without cookies and without storing anything on the visitor's device, and browsers that send Global Privacy Control or Do Not Track are not counted at all. No marketing cookies are in use, and enquiries are not added to a mailing list or sold, as the privacy notice says.

If we start measuring Meta ads, the site will ask visitors first, as our cookie banner guide describes. For the websites we build, we agree before each build what is stored, where and for how long, which is the list any privacy check starts from.

Mistakes to avoid

• Assuming a business outside California is outside the law.
• Assuming business contacts are exempt. That exemption ended with 2022.
• Pasting a large company's CCPA policy onto a small site. It promises request processes you do not run, and a promise you do not keep is a deceptive practice.
• Adding a Do Not Sell or Share link that leads nowhere, or ignoring Global Privacy Control once you are covered.
• Forgetting that tags added by an agency, a plugin or a booking widget run on your site and count as yours.
• Counting only customers. The second threshold counts everyone whose data you buy, sell or share, including visitors who never buy.

This is general information, not legal advice. Each state sets its own thresholds and can change them. If you may be near one, ask an adviser who works with US state privacy laws.