CCPA Compliance for Small Business: What You Must Do in 2026

This article provides general educational information about CCPA requirements. It is not legal advice. Businesses with specific compliance questions should consult a qualified privacy attorney.

The Thing Most CCPA Articles for Small Businesses Don’t Tell You

Many small businesses are not directly covered by the CCPA at all.

The California Consumer Privacy Act has explicit applicability thresholds. A typical small business — a 20-person marketing agency, a 15-person SaaS startup, a local retailer with an e-commerce site — sits below every one of them. Vendors selling “CCPA compliance packages” to five-person companies rarely mention this.

That doesn’t mean small businesses have no privacy obligations. It means the specific obligations differ depending on whether you meet the CCPA’s thresholds. This article has two parts: first, the threshold test that determines whether you’re covered; second, the compliance requirements that apply if you are. If you’re not covered by the CCPA directly, there are still real obligations from California’s privacy policy law, wiretapping statute, FTC rules, and a growing number of other state laws — and this article covers those too.

Start with the threshold test. Everything else depends on it.

Does CCPA Apply to Your Business?

The CCPA (as amended by the California Privacy Rights Act, CPRA) applies to for-profit businesses that do business in California and meet at least one of three thresholds. Meeting any single threshold triggers full CCPA compliance obligations.

Threshold 1 — Revenue: Annual global gross revenues exceeding $26,625,000 (the inflation-adjusted threshold for 2025–2026, up from the original $25 million statutory floor). This refers to total global revenue, not revenue from California customers specifically. A UK company earning £25 million globally that serves some California customers may meet this threshold.

Threshold 2 — Data volume: Annually buying, selling, receiving, or sharing the personal information of 100,000 or more California consumers or households. This is the threshold most likely to catch smaller businesses. A B2C SaaS product with 120,000 registered California users meets this threshold even if annual revenue is $2 million. Consumer, employee, and business-to-business data all count toward volume thresholds.

Threshold 3 — Data revenue: Deriving 50% or more of annual revenue from selling or sharing California consumers’ personal information. This primarily targets data brokers and advertising networks.

The honest assessment for most small businesses:

A business with under $26.625 million in revenue, fewer than 100,000 California consumer records, and revenue not primarily from data sales is not covered by the CCPA. This describes the majority of small businesses in most sectors.

A SaaS product or consumer app with a large California user base — even at low revenue — may be caught by the 100,000-record threshold. Count your active California users or customers. If you’re approaching or above 100,000, the CCPA applies.

“Doing business in California” does not require a physical California presence. Any business that targets California consumers, collects data from California residents, or operates a website accessible to California users and meeting the threshold criteria is subject to the CCPA.

What Is Personal Information Under CCPA?

The CCPA defines personal information broadly: any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household.

This includes: names, postal addresses, email addresses, IP addresses, cookie identifiers, browsing history and search history, geolocation data, purchasing history, inferences drawn from any of the above, and biometric data.

It does not include: publicly available information lawfully made available from government records, or truly de-identified data that cannot reasonably be re-identified.

Special categories of sensitive personal information receive heightened protection under CPRA. These include Social Security numbers, financial account details, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric data, health information, and sex life or sexual orientation. Businesses processing sensitive personal information must offer consumers a right to limit its use for purposes beyond the primary service.

The 2026 Updates: What Changed on January 1, 2026

Several significant CCPA changes took effect on January 1, 2026. If your business was previously compliant, these require review and likely updates to your processes.

Opt-out confirmation is now mandatory. Businesses must actively confirm to consumers that their opt-out request (including those submitted through the Global Privacy Control browser signal) has been processed. Displaying an “Opt-Out Request Honored” message on the website or in privacy settings immediately following a request is one acceptable method. The confirmation requirement applies to opt-outs submitted through any channel — cookie banners, “Do Not Sell or Share” links, and GPC signals alike.

Enhanced privacy policy disclosures. Privacy policies must now disclose personal information shared with service providers and contractors, not just third parties. Mobile apps must include a privacy policy link in their settings menu in addition to any existing placement. The distinction between “selling,” “sharing,” and disclosure to service providers must be clearly described.

Extended right to know. For businesses retaining personal information longer than 12 months, consumers can now request access to all their personal information going back to January 1, 2022 (or further, if data is retained that long). The response timeline remains 45 days, extendable to 90 with notice.

Automated Decision-Making Technology (ADMT) rules. Businesses using automated decision-making technology to make decisions about consumers — particularly in financial services, housing, education, employment, or healthcare — must provide a pre-use notice and offer a right to opt out. ADMT rules affecting high-stakes sectors became effective January 1, 2026, with full requirements in some categories active by January 1, 2027.

Global Privacy Control (GPC) signals must be honoured. Businesses subject to the CCPA must recognise and honour GPC signals sent by consumers’ browsers. GPC is a browser-level signal indicating a consumer’s opt-out preference. If a California consumer visits your website with GPC enabled, you must treat their visit as an opt-out of sale and sharing of personal information. As of 2026, 20 US states with comprehensive privacy laws require businesses to honour universal opt-out signals — GPC compliance is becoming a de facto national standard.

Cybersecurity audit requirements (phased rollout, new for 2026–2030). The CPPA finalised cybersecurity audit regulations that require qualifying businesses to conduct annual independent cybersecurity audits. This requirement applies to businesses meeting separate, higher thresholds beyond general CCPA applicability:

• Businesses deriving 50%+ of annual revenue from selling or sharing personal information
• Businesses with global gross revenue over $26.625M AND processing personal information of 250,000+ California consumers
• Businesses with global gross revenue over $26.625M AND processing sensitive personal information of 50,000+ California consumers

Most small businesses will not meet these cybersecurity audit thresholds. The phased compliance deadlines run from 2028 (businesses over $100M revenue) to 2030 (smaller businesses). If you’re approaching these thresholds, factor the audit requirement into forward planning.

CCPA Compliance Checklist for Covered Businesses

If your business meets one of the CCPA applicability thresholds, the following requirements apply.

1. Conduct a Data Inventory

Map what personal information your business collects, where it comes from, how it’s used, who it’s shared with, and how long it’s kept. This is the foundation of every other CCPA obligation.

Document:

• Categories of personal information collected (names, emails, IP addresses, browsing history, purchase history, etc.)
• Sources of collection (directly from consumers, from third parties, from analytics tools)
• Business or commercial purposes for collection
• Categories of third parties, service providers, or contractors the data is shared with
• Retention periods for each category

Update this inventory whenever you add a new data collection tool, analytics platform, or data-sharing relationship.

2. Update Your Privacy Policy

Your privacy policy must be posted prominently (typically linked in the footer of every page), written in plain language, and updated at least annually. CCPA-compliant privacy policies must include:

What to disclose:

• Categories of personal information collected in the past 12 months
• Categories of sources from which personal information is collected
• Business or commercial purposes for collecting, selling, or sharing personal information
• Categories of third parties, service providers, and contractors with whom personal information is shared
• Categories of personal information sold or shared (if applicable)
• Retention periods for each category of personal information (a CPRA addition that many pre-2023 policies still omit)

Consumer rights section: Describe each right and how to exercise it:

• Right to Know (access): how to request access and what you will provide
• Right to Delete: how to request deletion and applicable exceptions
• Right to Correct: how to request correction of inaccurate data
• Right to Opt Out: how to opt out of sale or sharing, and how you handle GPC signals
• Right to Limit Sensitive Personal Information Use: how to exercise this right if you process sensitive personal information
• Right to Non-Discrimination: a statement that you will not retaliate against consumers who exercise their rights

At least two request submission methods. The policy must describe at least two ways consumers can submit privacy rights requests — typically a designated email address and a web form.

Common gaps in existing policies:

• No mention of retention periods
• No GPC signal disclosure
• Outdated categories of data not reflecting recently added tracking tools
• No mention of service providers and contractors (only “third parties”)
• Rights described in legal jargon rather than plain language

3. Implement a “Do Not Sell or Share My Personal Information” Link

If your business sells or shares personal information (including sharing with advertising platforms and analytics providers in ways that constitute “sharing” under CCPA), you must post a clear and conspicuous “Do Not Sell or Share My Personal Information” link on your homepage.

The link must be clearly visible — not buried in a dropdown menu or accessible only through the privacy policy. California regulations specify it must appear on the homepage of your website.

Additionally, if you use a cookie management platform and serve opt-out preference signals through a cookie banner, the opt-out mechanism must actually function: clicking “Do Not Sell or Share” must stop the sale and sharing of personal information, not merely present a form with no backend effect.

4. Honor Global Privacy Control (GPC) Signals

As of January 1, 2026, you must detect and honour GPC browser signals from California consumers. When a consumer visits your site with GPC enabled, you must treat this as an opt-out of sale and sharing of their personal information — equivalent to them clicking the “Do Not Sell or Share” link.

Practically, this requires:

• Implementing GPC signal detection on your website (most consent management platforms now support this)
• Confirming that your advertising and analytics configurations stop selling/sharing when GPC is detected
• Displaying confirmation that the opt-out has been honoured (the new 2026 requirement)

If you use Google Ads, Meta Pixel, or other advertising platforms that constitute “sharing” under CCPA, your consent management platform must pass the GPC signal to these platforms so they cease using the data for targeted advertising when a consumer opts out.

5. Build a Consumer Rights Response Process

Consumers have the right to submit requests to access, delete, correct, and opt out of sale or sharing of their personal information. You must have a documented process to receive and respond to these requests within the required timelines.

Response timeline: 45 days from receipt of the request. You may extend to 90 days if you notify the consumer of the extension and the reason within the initial 45-day window.

Verification: You must verify the identity of the consumer before releasing personal information or deleting records. Verification methods must be proportionate to the sensitivity of the request — for access requests involving sensitive data, stronger verification is appropriate. You cannot require the consumer to create an account or provide information beyond what’s necessary for identification.

Right to Know requests must now cover extended history. For businesses retaining data beyond 12 months, consumers can request access going back to January 1, 2022. Ensure your data retrieval process covers your full retention window.

Build a request intake process:

• Designate a specific channel (email address, web form, or toll-free number) for privacy rights requests
• Log every request received and the date received
• Track the 45-day response deadline for each request
• Document the response provided
• Establish an escalation path for complex requests

No fee in most cases. You may not charge consumers for submitting privacy rights requests unless requests are manifestly unfounded or excessive, and even then, the fee must be reasonable. The default is free.

6. Implement Service Provider and Contractor Contracts

Any third party that processes personal information on your behalf — your CRM, email marketing platform, cloud storage provider, analytics tools, payroll processor — must be governed by a written contract if they are to qualify as a “service provider” or “contractor” under CCPA.

The contract must prohibit the service provider from:

• Selling or sharing the personal information
• Retaining, using, or disclosing the personal information outside the scope of the contract
• Combining the personal information with data from other clients

The contract must require the service provider to:

• Assist with consumer rights requests
• Implement reasonable security measures
• Notify you of any non-compliance with CCPA restrictions
• Delete or return personal information at the end of the relationship

Practical note: Most major SaaS providers (Google, Salesforce, Mailchimp, HubSpot, Microsoft, Zoom) offer CCPA-compliant Data Processing Agreements or service provider terms. Review and accept these in your account settings. For smaller local vendors, you may need to issue your own service provider agreement or addendum.

A September 2025 enforcement action fined Tractor Supply $1.35 million in part for failing to amend vendor contracts by compliance deadlines. Vendor contract gaps are a documented enforcement priority.

7. Address Children’s Privacy (Under-16 Rules)

The CCPA includes heightened requirements for data about minors:

• Consumers under 16 must opt in (not merely fail to opt out) before a business may sell or share their personal information
• For consumers aged 13–15, the minor themselves may provide this opt-in
• For consumers under 13, a parent or guardian must provide opt-in consent

If your service is directed at or likely to attract users under 16, implement age screening and ensure your consent mechanisms comply with these heightened standards. A business that has “actual knowledge” that a consumer is under 16 must apply the opt-in requirement regardless of whether the service is nominally adult-directed.

8. Train Your Team

CCPA requires that employees who handle consumer inquiries about privacy practices are informed about your privacy obligations and how to direct consumers to exercise their rights.

Practically, this means:

• Customer service staff know how to direct a consumer who asks about their privacy rights to the designated request intake channel
• Marketing staff understand what “selling” and “sharing” mean under CCPA and which data flows trigger the opt-out obligation
• IT and engineering staff understand the technical requirements for honouring opt-outs and GPC signals
• Documentation of training completion is maintained

What If You’re Below the CCPA Thresholds?

If your business doesn’t meet the CCPA applicability thresholds, the full regime above doesn’t apply. But several obligations remain regardless of business size.

California’s online privacy policy law (CalOPPA): Any operator of a commercial website or online service that collects personally identifiable information from California residents must post a conspicuous privacy policy. CalOPPA has no revenue or data volume threshold — it applies to any business with a website that collects data from California users. Your privacy policy must disclose: what personal information is collected, how it’s shared or sold, how users can review and request changes to their information, how you respond to “Do Not Track” signals, and whether third parties may collect information across your site.

California’s wiretapping statute (CIPA): California’s Invasion of Privacy Act (CIPA) is increasingly used in class action lawsuits against businesses using chat widgets, session recording software, pixel tracking, and analytics tools that capture communications. Several plaintiff firms have specifically targeted small businesses with CIPA claims arguing that embedding analytics tools on a website constitutes “wiretapping” without consent. If you use live chat software, session replay tools, Meta Pixel, or similar analytics that capture user interactions in detail, review your cookie consent and disclosure obligations carefully. CIPA claims do not require proving the CCPA thresholds — they can target any business operating in California.

FTC Act Section 5: The FTC requires that privacy policies accurately describe your actual data practices. A policy saying you don’t share data when you use a dozen advertising pixels that share data is a deceptive practice under Section 5. This applies to any business engaged in interstate commerce, regardless of size.

Other US state privacy laws: As of 2026, 20 states have comprehensive consumer privacy laws. Several — including Colorado, Connecticut, Virginia, Texas, and Oregon — have thresholds lower than CCPA or different applicability criteria. If your business processes personal information of residents of multiple states, check whether those laws apply independently of CCPA. A B2B SaaS company below CCPA’s thresholds may still face obligations under Texas’s TDPSA or Virginia’s CDPA.

CCPA vs GDPR: Key Differences for Businesses Managing Both

Many small businesses with California customers also have EU users and face GDPR obligations simultaneously. The frameworks differ in important ways.

For businesses managing both: the GDPR’s stricter opt-in model generally satisfies CCPA’s opt-out requirements for EU users. Implement geo-detection to apply the appropriate consent standard based on user location — GDPR consent mechanisms for EU users, CCPA opt-out mechanisms for California users.

CCPA Fines and Enforcement: What’s Actually Happening

The California Privacy Protection Agency (CPPA) and the California Attorney General jointly enforce CCPA. Enforcement has accelerated significantly since 2024.

CCPA fines are per violation: $2,500 per unintentional violation, $7,500 per intentional violation. In the first quarter of 2026 alone, California regulators issued over $4 million in fines related to opt-out violations — including fines against Disney ($2.75 million) and PlayOn Sports ($1.1 million) for failure to properly implement opt-out mechanisms, and Ford ($375,000) for opt-out failures. These are large companies, but the enforcement pattern shows regulators actively looking at opt-out compliance.

Small businesses are more likely to face enforcement through indirect routes: class action lawsuits under CIPA (the wiretapping statute) where plaintiffs target tracking pixel and session recording use without consent, or AG actions following consumer complaints about failure to respond to rights requests or deceptive privacy policies.

The highest practical risk for a small business that is CCPA-covered is a failure to respond to rights requests within 45 days — an easily documented violation — or a privacy policy that materially misrepresents data practices.

CCPA Compliance Checklist Summary

What to Avoid

Don’t assume a “CCPA compliant” cookie banner solves everything. A cookie banner that offers an opt-out option is one compliance element. It doesn’t cover rights request processes, service provider contracts, privacy policy accuracy, retention period disclosures, or GPC signal handling. Compliance platforms that promise full CCPA compliance from a cookie banner alone are selling a partial solution.

Don’t ignore GPC signals because they’re inconvenient for your advertising model. As of 2026, failure to honour GPC is a documented enforcement priority in California. The opt-out confirmation requirement adds a visible, auditable signal of compliance. Businesses that detect GPC and do nothing — or that pass GPC signals to advertising platforms but fail to verify those platforms actually stop sharing — are exposed.

Don’t write a privacy policy that doesn’t match your actual data practices. The FTC’s and CPPA’s enforcement records are full of cases where businesses were penalised not for the underlying data collection, but for misrepresenting it in their policy. If your privacy policy says you don’t sell data and you share data with Meta Pixel for advertising targeting, that’s a deceptive practice regardless of your revenue or user volume. Audit your policy against your actual data flows before publishing it.

Don’t overlook state privacy laws outside California. The multi-state landscape as of 2026 means a business below CCPA’s thresholds may still face obligations under Texas (TDPSA), Virginia (CDPA), Colorado (CPA), Connecticut (CTDPA), or a dozen other state laws. The applicability thresholds, consumer rights, and opt-out requirements vary by state. A business with significant user bases in multiple states should assess each law’s applicability independently.

Final Verdict

Most small businesses with under $26.625 million in revenue and fewer than 100,000 California consumer records are not directly covered by the CCPA’s full compliance requirements. That’s the honest starting point most articles don’t lead with.

For businesses that are covered: the 2026 updates add material new requirements — particularly opt-out confirmation, GPC signal handling, and the ADMT notification framework — on top of the existing rights request, privacy policy, and service provider contract obligations. If your CCPA programme was set up before January 2026, it needs a review against these updates.

For businesses below the thresholds: CalOPPA’s privacy policy requirement applies to any website collecting data from California users. CIPA class action risk applies to any business using tracking pixels, chat widgets, or session replay tools without adequate disclosure and consent. The FTC requires that your privacy policy accurately describes your data practices.

None of these are reasons to panic. They are reasons to review your privacy policy, verify your data practices match what you’re disclosing, implement a basic cookie consent mechanism if you use advertising or analytics tools, and consult a privacy attorney if your data practices are complex or you serve a large California user base.

Frequently Asked Questions

Does CCPA apply to my small business?

Only if you meet at least one of three thresholds: annual global gross revenues over $26,625,000 (the 2026 inflation-adjusted figure); buying, selling, or sharing personal information of 100,000 or more California consumers or households annually; or deriving 50% or more of annual revenue from selling or sharing California consumers’ personal information. A business below all three thresholds is not directly covered by the CCPA’s full consumer rights framework — though California’s broader privacy policy law (CalOPPA) applies to any website collecting data from California users regardless of size.

What is the difference between “selling” and “sharing” personal information under CCPA?

Under CCPA as amended by CPRA, “selling” means disclosing personal information to a third party for monetary or other valuable consideration. “Sharing” means disclosing personal information to a third party for cross-context behavioural advertising — targeted advertising based on a consumer’s activity across different businesses, websites, or apps. Many businesses that use Meta Pixel or Google advertising are “sharing” personal information even if they receive no direct payment for the data, because the advertising platform uses that data to target ads across other contexts. Both selling and sharing trigger the opt-out obligation and the “Do Not Sell or Share My Personal Information” link requirement.

What is the Global Privacy Control and do I have to honour it?

The Global Privacy Control (GPC) is a browser signal that consumers can enable to automatically communicate their opt-out preference to websites they visit. When a California consumer visits a CCPA-covered website with GPC enabled, the business must treat this as a valid opt-out of sale and sharing of personal information — equivalent to the consumer clicking the “Do Not Sell or Share” link. As of January 1, 2026, businesses must also confirm to the consumer that their opt-out has been processed when submitted through GPC or any other channel. Most consent management platforms (OneTrust, Cookiebot, Termly) now support GPC detection. Implementation requires both detecting the signal and ensuring your downstream advertising and analytics configurations actually stop the relevant data sharing.

How quickly must I respond to CCPA consumer rights requests?

You have 45 calendar days from the date you receive a verifiable consumer request. You may extend the response period to 90 days total if you notify the consumer of the extension and the reason within the initial 45-day window. You must acknowledge receipt of the request within 10 business days in most cases. Failure to respond within 45 days is itself a CCPA violation — the easiest enforcement target because it’s fully documented. Build a tracking system (even a simple spreadsheet) that records the date each request is received and the deadline for response.

Does CCPA compliance satisfy GDPR requirements?

No. CCPA and GDPR are separate legal frameworks with different requirements. Some controls overlap — data inventories, privacy notices, consumer rights processes, and vendor agreements are required by both — and building those controls to GDPR’s stricter standard often satisfies CCPA requirements for the same users. But the frameworks have fundamental differences in legal basis (CCPA defaults to opt-out; GDPR requires opt-in consent for most purposes), scope (CCPA has size thresholds; GDPR applies to any processing of EU resident data regardless of company size), enforcement mechanisms, and documentation requirements. A business that is GDPR compliant has addressed many of the same underlying obligations, but should conduct a CCPA-specific review rather than assuming GDPR compliance is sufficient.

This article provides general educational information about CCPA requirements. CCPA and CPRA requirements are subject to ongoing regulatory development by the California Privacy Protection Agency. Businesses with specific compliance questions, particularly those approaching the applicability thresholds or operating in multiple regulated jurisdictions, should consult a qualified privacy attorney. For authoritative guidance, see the California Privacy Protection Agency and the California Attorney General CCPA resources.

Related reading on SmallBiz Defense:

• GDPR Compliance Checklist for Small Business Owners (2026)
• What Is SOC 2 Compliance? A Plain-English Guide for SMBs (2026)
• Best Dark Web Monitoring Tools for Small Business in 2026 (Tested)