What Is the CCPA? Applicability, Sale and Sharing, and GPC Checks
Shusaku Yosa
The California Consumer Privacy Act (CCPA) concerns the privacy rights of California consumers. A company outside California, including one based in Japan, may have obligations. But a California website visit or the presence of an advertising tag does not by itself establish the company’s legal role. Gather business facts, data flows, and contractual terms before making that determination.
This overview uses official materials checked on October 9, 2026. The worksheets organize facts for review; they do not automatically decide a particular business’s legal status.
Separate the CCPA, CPRA, and CPPA
The CCPA is the law. The California Privacy Rights Act (CPRA) amended it. The California Privacy Protection Agency (CPPA) is the regulator. The CPPA FAQ explains their relationship and the amended framework.
Consumer rights include knowing, deleting, and correcting information; opting out of sale or sharing; limiting certain uses and disclosures of sensitive information; and equal treatment when exercising rights. Conditions and exceptions differ. A single consent setting is not a complete rights-handling system.
A comparison with Europe also needs care. The GDPR is not “consent for everything,” and the CCPA is not “anything is allowed until refusal.” The EDPB’s explanation of legal bases identifies bases other than consent. Rules governing storage or access on a device are a separate question from the basis for processing personal data.
Collect the facts needed for applicability
The CPPA describes foundational conditions involving a for-profit business doing business in California, collecting consumers’ personal information, and determining processing purposes and means, alongside the relevant thresholds. Headquarters location and raw website traffic are insufficient substitutes for these facts.
Fact | Evidence to gather | Common mistake |
|---|---|---|
Business conditions | Entity, California activity, collection, and decision-making | Treating a visit as a complete applicability test |
Annual gross revenue | Relevant year and financial reporting scope | Using an outdated threshold or unsupported calculation |
Buying, selling, or sharing | Annual California consumer or household scope | Counting every processing event or page view |
Revenue composition | Revenue attributable to sale or sharing | Confusing total revenue with this source |
Other roles and exceptions | Contracts, related entities, and information categories | Assuming no business status means no obligations |
The adjusted revenue threshold amount is USD 26,625,000 from January 1, 2025. The CPPA adjustment table explains odd-year adjustments, rather than annual revisions. Check the applicable amount and calculation conditions for the relevant year.
The other thresholds concern buying, selling, or sharing information of at least 100,000 California consumers or households, or deriving at least 50% of annual revenue from selling or sharing California residents’ information. Do not add generic “processing” to the 100,000 test. Service providers, contractors, and other recipients can have separate obligations, so include the actual contractual role in the review.
Classify data flows, not tool labels
Sale is not limited to cash transactions. Sharing has a specific connection to cross-context behavioral advertising. Calling a tool “analytics” or a recipient a “vendor” does not settle the classification. Review the information, purpose, recipient’s permitted uses, and contractual restrictions. The California Attorney General’s CCPA guide explains the sale and sharing opt-out.
Flow | Facts to examine | Decision or action | Evidence |
|---|---|---|---|
Page to advertising recipient | Identifier, URL, purpose, and recipient use | Sale/sharing assessment and opt-out effects | Settings, transfers, and contract |
Customer system to provider | Fields, processing, and independent use | Role, restrictions, and rights-request coordination | Contract and handling record |
App through an SDK | Version, identifier, purpose, and destination | App, device, and recipient controls | Configuration and test results |
Request intake to internal systems | Information, owner, exceptions, and timing | Required checks and downstream actions | Decision, completion, and response |
A fictional entry might read: product page; browser identifier and page URL; advertising platform; advertising purpose; contractual role awaiting review; GPC behavior untested; advertising owner and counsel to resolve. This is more useful than writing “outsourced, therefore compliant.”
Trace browser and server transfers separately. A blocked browser tag does not establish that no server-side transfer occurs. For app identifiers, use the AAID and SDK checklist and assess platform requirements separately from legal classification.
Connect GPC and rights requests to processing
Global Privacy Control (GPC) is one mechanism for communicating a sale/sharing opt-out. Covered businesses must honor qualifying opt-out preference signals. A visible banner or link is not evidence that a received choice reaches every relevant processing path.
- Identify where choices and signals enter the system and the scope they should affect.
- Map relevant browser, server, and recipient processing paths.
- Test before and after a choice, recording information, conditions, dates, and results.
- Design checks, deadlines, and coordination appropriate to each type of rights request.
- Resolve unknown paths and compare the consumer response with completed actions.
This is an operational sequence, not a replacement for each right’s legal conditions. Do not apply identical identity checks to every request. Distinguish clicking a deletion control from completing the applicable data-handling actions.
Measurement teams also need to understand the scope of honored choices. When reviewing PPC advertising metrics, do not interpret missing observations as proof that the underlying customer behavior stopped.
Distinguish effective dates from compliance deadlines
The CPPA final-regulation announcement records OAL approval on September 22, 2025, and an effective date of January 1, 2026. Effectiveness is distinct from the compliance deadline for a particular requirement and covered activity.
The agency’s FAQ identifies January 1, 2027, for ADMT-specific compliance. Risk assessments and cybersecurity audits also require checking scope and phased deadlines. Avoid the blanket statement that every business had to complete every audit immediately in 2026.
Maintain a register with the rule, processing activity, applicability conditions, effective date, specific deadline, provision checked, and owner. Check detailed audit thresholds, disclosure periods, or penalty calculations against the relevant provisions and facts rather than extrapolating from a headline.
Assign facts and decisions across the team
Marketing should explain purposes, recipients, and advertising uses. Development should establish actual transfers, SDK behavior, choice propagation, and changes. Legal reviewers should assess applicability, roles, contracts, exceptions, and deadlines. Identify both the decision owner and the people supplying missing facts.
Recheck changes to recipients, purposes, and controls instead of carrying forward an old approval unchanged. If the existing system cannot be explained, start with an inventory of business and system dependencies. A useful control connects the legal assessment, contractual terms, and demonstrated technical behavior, with unresolved items clearly assigned.