Definitions: Which Businesses the CCPA Covers, and What Counts as Sensitive Personal Information

What it requires

Defines the terms the rest of the CCPA runs on. Subdivision (d)(1) sets three independent scope triggers for a for-profit entity doing business in California: annual gross revenues above the threshold in (d)(1)(A); annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50 percent or more of annual revenues from selling or sharing personal information. Meeting any one puts a business in scope. The statute still prints twenty-five million dollars ($25,000,000) in (d)(1)(A), but that figure is expressly "as adjusted pursuant to subdivision (d) of Section 1798.199.95" — the CPPA raised it to $26,625,000 effective January 1, 2025, and that is the amount in force through 2026, with the next adjustment due January 1, 2027. Subdivision (ae) defines sensitive personal information, which since SB 1223 (effective January 1, 2025) includes neural data alongside government identifiers, financial account credentials, precise geolocation, genetic and biometric data, health data, and sex life or sexual orientation. That statutory list is the floor rather than the ceiling: the regulatory definition at 11 CCR § 7001(bbb)(4) has, since January 1, 2026, also treated all personal information of a consumer the business actually knows is under 16 as sensitive personal information.

Legal text (excerpt)

(A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households. (C) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.

Primary source