Definitions: Which Businesses the CCPA Covers, and What Counts as Sensitive Personal Information

What it requires

Defines the terms the rest of the CCPA runs on. Subdivision (d)(1) sets three independent scope triggers for a for-profit entity doing business in California: annual gross revenues above the threshold in (d)(1)(A); annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or deriving 50 percent or more of annual revenues from selling or sharing personal information. Meeting any one puts a business in scope. The statute still prints twenty-five million dollars ($25,000,000) in (d)(1)(A), but that figure is expressly "as adjusted pursuant to subdivision (d) of Section 1798.199.95". The CPPA raised it to $26,625,000 effective January 1, 2025, the amount in force through 2026, with the next adjustment due January 1, 2027. Subdivision (ae) defines sensitive personal information, and the list is longer than the one most privacy policies print: government identifiers in (ae)(1)(A); account log-in and financial account credentials in (B); precise geolocation in (C); the protected characteristics grouped in (D), namely racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership, citizenship or immigration status having joined that group through AB 947 (Stats. 2023, Ch. 551) effective January 1, 2024; the contents of a consumer’s mail, email, and text messages in (E) unless the business is the intended recipient; genetic data in (F); and, since SB 1223 took effect January 1, 2025, neural data in (G). Subdivision (ae)(2) adds biometric processing for unique identification, and health, sex life, or sexual orientation data. That statutory list is the floor rather than the ceiling: the regulatory definition at 11 CCR § 7001(bbb)(4) has, since January 1, 2026, also treated all personal information of a consumer the business actually knows is under 16 as sensitive personal information.

Statute text

(A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households. (C) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information. [...] (ae) “Sensitive personal information” means: (1) Personal information that reveals: [...] (D) A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

California Consumer Privacy Act / California Privacy Rights Act, § 1798.140Read the full section from California Privacy Protection Agency (CalPrivacy)