CCPA / CPRA

CCPA/CPRA Applicability & Exposure Calculator

Check whether the CCPA applies to your business and estimate statutory penalty exposure.

Who the CCPA applies to

The California Consumer Privacy Act, as amended by the CPRA, applies to a for-profit business that does business in California and meets any one of three tests (Cal. Civ. Code 1798.140(d)):

Annual gross revenue over $26,625,000 (the $25 million threshold after the January 2025 inflation adjustment);
Buying, selling or sharing the personal information of 100,000 or more California consumers or households; or
Earning 50% or more of annual revenue from selling or sharing personal information.

You do not need an office in California; selling to Californians is enough.

Fines and damages (adjusted January 2025)

What	Amount
Per violation	Up to $2,663
Per intentional violation, or one involving minors' data	Up to $7,988
Statutory damages in private lawsuits after certain data breaches	$107 to $799 per consumer per incident, or actual damages if greater

The breach damages apply only when certain personal information is exposed because the business failed to keep reasonable security, which is why security controls matter even to companies that never sell data. The California Privacy Protection Agency adjusts the amounts every two years.

What consumers can ask for

To know what is collected, to delete it, to correct it, to opt out of its sale or sharing, and to limit the use of sensitive personal information.

New: cybersecurity audits

Regulations in force since 1 January 2026 require independent annual cybersecurity audits for businesses whose processing presents significant risk. The first certifications are due from 1 April 2028 for businesses with over $100 million in revenue, with smaller ones following in 2029 and 2030.

The calculator above counts every consumer as a separate violation, which is a worst case: regulators and courts decide how violations are counted. We do the reasonable-security side. See the US state privacy law checker for other states.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Applicability: the tool runs the three tests in Cal. Civ. Code 1798.140(d) - gross revenue over US$26,625,000 (the US$25 million threshold after the CPPA’s January 2025 inflation adjustment); buying, selling or sharing the personal information of 100,000 or more California consumers or households; or earning 50% or more of revenue from selling or sharing it. Meeting any one is enough.
If none is met, it stops and reports that the law likely does not apply.
Exposure: consumers x US$2,663 per violation (standard) or x US$7,988 (intentional, or involving minors’ data) - the January 2025 adjusted amounts of the US$2,500 / US$7,500 in 1798.155(a) and 1798.199.90(a). The tool assumes one violation per consumer, a worst case; the statute does not say how violations are counted.
Breach damages: consumers x US$107 to US$799, the adjusted statutory damages in 1798.150, shown separately because they apply only to certain data breaches.
The headline is the standard scenario (or the intentional one if you tick that box), with a plus sign because breach damages and other remedies can come on top.

Worked example

The calculator run on its default inputs:

Annual gross revenue: $30 million
California consumers or households: 120,000 records
Revenue from selling/sharing personal info: 0%
Violations likely intentional (or involving minors)?: No

CCPA/CPRA likely applies - penalty exposure estimated

$319.6M+

Annual gross revenue over $26,625,000 (the $25M threshold as adjusted from Jan 1, 2025): $30,000,000 → MET
≥ 100,000 CA consumers or households bought, sold or shared: 120,000 → MET
≥ 50% of revenue from selling/sharing PI: 0% → not met
Standard scenario ($2,663 per violation × 120,000 consumers): $319,560,000
Intentional / minors scenario ($7,988 per violation): $958,560,000
Private right of action (breach) - $107-$799 per consumer per incident: $12,840,000-$95,880,000

US$30 million revenue and 120,000 consumers meet two of the three tests. Standard exposure is 120,000 x US$2,663 = US$319,560,000 (shown as $319.6M+); the intentional scenario is 120,000 x US$7,988 = US$958,560,000; breach damages would range from US$12,840,000 to US$95,880,000.

Sources

Cal. Civ. Code 1798.140 (California Legislative Information) - the three "business" thresholds in subsection (d)
Cal. Civ. Code 1798.155 - CPPA administrative fines of US$2,500 / US$7,500 per violation
Cal. Civ. Code 1798.199.90 - civil penalties in Attorney General actions
Cal. Civ. Code 1798.150 - US$100-750 statutory damages per consumer per incident for certain breaches
California Privacy Protection Agency - CPI adjustments - US$26,625,000, US$2,663 / US$7,988 and US$107-799 from 1 January 2025

Sources last checked September 2026.

Limitations

Counting every consumer as a separate violation is the worst case; regulators and courts decide how violations are counted. The tool ignores exemptions (for example data covered by HIPAA or GLBA), the for-profit requirement, and the conditions for breach damages (a qualifying breach of certain data types caused by a failure to keep reasonable security). This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.