Yes, any website operator that does business with at least 100,000 California residents and meets relevant income thresholds is subject to the CPRA.