The CCPA, as amended by the CPRA, applies to any business that collects, processes, sells, or shares the personal information of California residents and meets certain thresholds. These thresholds include having an annual gross revenue of over $25 million, collecting the personal information of 50,000 or more California residents, households, or devices annually, or deriving 50 percent or more of their annual revenue from selling the personal information of California residents.

The CCPA and CPRA have extraterritorial reach, meaning that businesses located outside of California that meet the requirements are also subject to these laws. Furthermore, the thresholds are calculated taking into account overall revenue, not just that revenue made in California or from selling personal information from California residents.