Does the CCPA apply to my business? Thresholds explained

Does the CCPA apply to my business? The three tests

The CCPA applies to a for-profit business that does business in California, collects consumers' personal information and meets at least one of three thresholds. Meeting any one is enough, and the tests are about size and data activity, not about where the company is headquartered. The California Attorney General's CCPA page lists the three tests, and the California Privacy Protection Agency FAQ gives the current revenue figure. This is general information, not legal, tax or financial advice.

Revenue per employee varies widely, so headcount alone does not settle the revenue test. A company with 50+ full-time employees at peak (contractors excluded) may or may not reach the figure; the owner or CFO should compare actual gross revenue for the preceding calendar year with the number in the CPPA FAQ.

What counts as doing business in California?

The tests assume the business is a for-profit entity doing business in California and collecting consumers' personal information. A company with customers, employees or operations in California is the typical case. A company with no California nexus has a harder fact question, and the answer is for counsel, not for a partner.

Note the word consumer. The statute defines it as a California resident, which is not limited to retail customers. How employee and business-contact records are treated is a question for counsel. The comparison in CCPA versus GDPR for employee data shows how the two regimes treat workplace records.

How does applicability affect a data license?

Applicability changes what the company must do before records leave the building. If the CCPA applies, a company that sells or shares personal information, or discloses it to a service provider or contractor, needs a written agreement limiting use to specified purposes under the statute's contract rules. That is one reason the roles matter; see service provider versus contractor versus third party. If the CCPA does not apply, other rules can still reach the data, including other states' laws, contracts, sector rules and the company's own privacy promises.

Do not read "not covered" as "no restrictions." A company outside the CCPA may still be covered by GLBA, see whether GLBA covers business customers' data, or bound by customer contracts.

A quick screen for a partner conversation

Ask these four questions in plain words and write down the owner's answers without asking for any records.

1. Did last year's gross revenue reach the figure on the CPPA FAQ?
2. Does the company have customers, staff or operations in California?
3. Does it buy, sell or share personal information on one hundred thousand or more California residents or households?
4. Has it ever earned a large share of its income from selling or sharing personal information?

A yes to question 1 or 3, combined with a yes to question 2, means the CCPA is probably in the picture; move on to scoping with the company's counsel. Four noes still do not close the question, so the owner should take advice before treating it as settled.

What to say

Licensed professionals should check their own rules on referral fees and disclosure. The partner reward is a share of SourceX's fee and is never deducted from what the company receives; partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

When the question is a red flag

If the records are mostly consumer personal information with no licensing basis, applicability is not the issue; the licensing basis is. Likewise, field-of-use and permitted-use limits belong in the license either way, as explained in field-of-use restrictions. Confirm thresholds, which can change, with the company's counsel and the CPPA.

Next step

Ask the owner the four screening questions, then register as a partner and introduce companies with 50+ full-time employees at peak (contractors excluded). Owners can also run the company fit checker, and the process is explained in how SourceX referrals work. Confirm applicability with the company's own counsel.