The CCPA applies to businesses that meet one or more of the following criteria:
1 . Annual Gross Revenue: Businesses with an annual gross revenue of $25 million or more in the preceding calendar year.
2. Personal Information Threshold: Businesses that buy, receive, sell, or share the personal information of 50,000 or more California residents, households, or devices annually.
3. 50% Revenue from Personal Information: Businesses that derive 50% or more of their annual revenues from selling the personal information of California residents.
4. Parent Company or Subsidiary: The CCPA also applies to any entity that controls or is controlled by a business that meets the above criteria and that shares common branding with that business.
The CPRA maintains the same criteria as the CCPA but adds a new category for businesses that handle the personal information of 100,000 or more consumers or households, broadening the scope of covered entities.
It's important to note that even if a business is not physically located in California, it may still be subject to the CCPA if it meets any of the criteria mentioned above and collects or processes personal information of California residents.