You must comply with the CPRA if you are a for-profit organizations that do business in California, collect the personal data of Californians or has it collected for them, and fits one or more of these criteria:
Buys, sells, or shares the personal information of 100,000 people or households.
Creates 50% or more of their revenue through the sale or sharing of personal information.
Had $25 million in gross revenue in the preceding calendar year.