CCPA/CPRA for Small Online Stores: Does It Apply to You?

The short answer

Most small online stores are not covered by the CCPA, because they have less than about $26.6 million in annual revenue, don’t make half their money from selling data, and don’t buy, sell or share the personal information of 100,000 or more California consumers or households.

The catch is the last test. “Sharing” has a specific meaning: passing personal information to a third party for cross-context behavioral advertising, even when no money changes hands. A store that runs retargeting or ad-network pixels on a site with a lot of California traffic should do the count rather than assume it’s too small.

A note on names: you’ll see “CCPA” and “CPRA” used for the same rules. The CPRA amended the CCPA, and the current statute and regulations are published by the California Privacy Protection Agency (CPPA) under the CCPA name. This guide uses “CCPA.”

Who counts as a covered “business”

Under the statute (Civil Code § 1798.140(d)), a covered business is a for-profit entity that collects consumers’ personal information, decides why and how it’s processed, does business in California, and meets at least one threshold. The CPPA’s one-page guide, “Does My Business Need To Comply With The CCPA?”, turns that into a checklist:

The three thresholds, with the current figures:

Two more rules can bring a business in. An entity that controls, or is controlled by, a covered business and shares common branding with it can be covered, and some joint ventures can be too. If your store is part of a larger group, review those clauses with your lawyer.

Why you’ll see two different revenue numbers

The statute says $25,000,000, adjusted for inflation. The law requires the CPPA to update its monetary amounts on January 1 of every odd-numbered year, and the CPPA’s CPI adjustment page lists the revenue threshold as $26,625,000 from January 1, 2025. The Attorney General’s CCPA page, updated in August 2026, still shows “over $25 million.” Use the CPPA figure, and expect it to change again on January 1, 2027.

Note also that the two CPPA pages word the test slightly differently (“over” in the compliance guide, “or more” in the FAQ). For a small store, that difference won’t matter; if your revenue is right at the line, ask your lawyer.

The threshold to look at closely: 100,000 consumers or households

This test isn’t about how many customers you have or how many visitors you get. It counts the California consumers or households whose personal information you buy, sell or share in a year. Two definitions in the statute decide whether you do any of that:

1. Sell means disclosing or making available a consumer’s personal information to a third party for money “or other valuable consideration.”
2. Share means disclosing or making available a consumer’s personal information to a third party for cross-context behavioral advertising, whether or not for money. Cross-context behavioral advertising is targeting ads to someone based on their activity across other businesses, websites, apps or services.

And “personal information” is broad. The statute lists identifiers such as an IP address, online identifier, email address or “unique personal identifier,” and it defines unique identifiers to include cookies, beacons, pixel tags and similar technology. It also covers commercial information such as products purchased or considered.

Put those together and the risk for an online store becomes clear. In 2022 the Attorney General settled with the retailer Sephora for $1.2 million. According to the Attorney General’s announcement, Sephora’s arrangement with third-party companies that tracked shoppers on its website “constituted a sale of consumer information under the CCPA,” and Sephora hadn’t told shoppers or let them opt out, including through the Global Privacy Control signal.

For a small store, the practical question is: which tools on my site send visitor data to a company that uses it beyond serving me, for example to target ads across other sites? Retargeting and ad-network pixels are the usual candidates. Tools that process data only on your behalf, under an appropriate contract, are treated differently; the CPPA describes service providers and contractors as parties that contract with businesses to process personal information, with obligations of their own.

A quick self-check for your store

1. Pull last year’s revenue. If it’s over $26,625,000, you’re covered (assuming you do business in California). Most small stores can stop here with a “no.”
2. List every tag and integration that receives customer or visitor data. Include analytics, ad pixels, email tools, review widgets, chat, affiliate scripts and any customer list you upload to an ad platform.
3. Mark each one as “processes for us only” or “may use the data for its own purposes or for advertising across sites.” Read the vendor’s terms or data processing addendum; if you can’t tell, treat it as the second kind until you confirm.
4. Estimate how many California consumers or households reach the second group in a year. Your analytics can show visitors by state; your order data shows California buyers. Remember that households count too, so the figure isn’t just logged-in customers.
5. If the estimate is anywhere near 100,000, either reduce the sharing (remove or reconfigure the tools) or plan to comply, and get legal advice on the count.

If you are covered: what you have to do

The full list is long, but for an online store the core obligations from the statute, the CCPA regulations and the CPPA FAQ come down to these:

1. A privacy policy. Link to it from your homepage and other pages using the word “privacy,” include how to submit requests, and update it at least once every 12 months.
2. A notice at collection. Tell people what you collect, why, whether you sell or share it and how long you keep it, at or before the point you collect it. Details below.
3. Ways to submit requests. Consumers can ask to know, delete and correct their information. Businesses generally need at least two methods, but the CPPA says a business that operates exclusively online only needs to provide an email address.
4. Deadlines. Confirm receipt of requests to know, delete or correct within 10 business days and respond within 45 calendar days (extendable by another 45 with notice).
5. If you sell or share: a “Do Not Sell or Share My Personal Information” link (or the alternative “Your Privacy Choices” label), honoring opt-out preference signals such as the Global Privacy Control, and acting on opt-outs as soon as feasibly possible and within 15 business days at most.
6. Sensitive personal information. If you use it beyond the purposes the law allows, you also need a “Limit the Use of My Sensitive Personal Information” link (or the alternative label).
7. No discrimination. You can’t penalize people for exercising their rights.

What goes in the notice at collection

Section 7012 of the regulations spells this out. The notice must include:

1. The categories of personal information you collect, including any sensitive categories, written so that people understand what’s being collected.
2. The purposes for which each category is collected and used.
3. Whether each category is sold or shared.
4. How long you intend to keep each category, or the criteria you use to decide.
5. If you sell or share, a link to your notice of the right to opt out.
6. A link to your privacy policy.

Here’s an illustrative outline of how a small store might organize that information. Your own categories, purposes and retention periods depend on your tools and practices, so treat it as a format, not wording to copy:

Where to put it: for online collection, the regulations give the example of a conspicuous link on your site’s introductory page and on every page where personal information is collected. For a web form, such as checkout or a newsletter sign-up, a conspicuous link near the input fields or near the submit button. You can link straight to the relevant section of your privacy policy, but sending people to the top of the policy so they have to scroll to find the information doesn’t count. And if you don’t give the notice, the regulations say you shall not collect the information.

Opt-outs: three details that trip up online stores

1. A cookie banner isn’t an opt-out method. Section 7026 of the regulations says a cookie banner or cookie controls is not by itself an acceptable method for opting out of sale or sharing, because cookies concern collection, not sale or sharing. Online businesses must accept opt-out preference signals plus at least one other method, such as an interactive form behind the “Do Not Sell or Share” link.
2. The Global Privacy Control must work. The Attorney General’s page says the GPC must be honored as a valid request to stop selling or sharing. The Sephora settlement was partly about ignoring it.
3. Your tools are your responsibility. In May 2025 the CPPA fined the clothing retailer Todd Snyder $345,178. Its privacy portal had been misconfigured so opt-out requests went unprocessed for 40 days, and it asked for more information than necessary, including identity verification before people could opt out. The CPPA’s enforcement head said using a consent management platform “doesn’t get you off the hook for compliance.” Test your opt-out flow yourself, and don’t ask for ID to process an opt-out.

Penalties

The figures below are the inflation-adjusted amounts in effect since January 1, 2025, from the CPPA’s adjustment page:

The Attorney General notes that consumers can’t sue for most CCPA violations; private lawsuits are limited to data breaches. Other violations are enforced by the CPPA (which now also calls itself CalPrivacy) and the Attorney General.

What about the 2026 regulations?

New regulations on automated decision-making technology (ADMT), privacy risk assessments and cybersecurity audits became effective on January 1, 2026, with some compliance deadlines phased in during 2027 and 2028. The CPPA FAQ says businesses must meet the ADMT-specific requirements by January 1, 2027. If you’re below the thresholds, they don’t change your answer; if you’re covered, ask your lawyer which of them reach your store.

If you’re not covered

Falling below the thresholds means the CCPA’s specific obligations don’t apply to you. It doesn’t mean privacy stops mattering. The CPPA notes that businesses not subject to the CCPA can voluntarily certify that they comply. Even without going that far, a clear privacy policy, honest descriptions of the tools on your site and a working way to answer questions about personal data are good practice, and they keep you ready if you grow past a threshold. Other states have privacy laws of their own: in September 2025 the CPPA announced a joint sweep with the attorneys general of Colorado and Connecticut into businesses that don’t honor Global Privacy Control opt-outs. Check the rules in the states where most of your customers live as well.

Where marketingLABO fits

marketingLABO is a marketing tool, not a compliance tool, but it’s one of the tools you’d list in the self-check above, so here’s what you need to know. Our privacy policy explains that the tracking tag collects information about visitors to the sites where it’s installed, such as pages viewed, date and time of viewing, IP address, cookies, browser type and information entered in forms, and shows it in your dashboard. We handle that information on your behalf, and our terms say we don’t view, change or provide it to third parties except at your request, as required by law, or as needed for maintenance and failures. Whether that meets the CCPA’s contract requirements for service providers is a question to review with your lawyer.

For your notice at collection and privacy policy, the tag means you collect identifiers (IP address and a cookie-based visitor ID), internet activity on your site (pages viewed and when), and whatever people type into forms. List those, the purposes (for example, analyzing visits, showing on-site banners and sending the emails people signed up for), and how long you keep them.

What the product doesn’t do: it has no consent management platform, no “Do Not Sell or Share” link and no handling of the Global Privacy Control signal. If you’re covered and sell or share data through other tools, you’ll need to handle opt-outs elsewhere. On the email side, unsubscribed contacts aren’t sent newsletters or the remaining emails in a journey. Newsletters are on the Light plan and journeys on the Standard plan; see the pricing section. For US email rules, see our CAN-SPAM compliance checklist, and if you also sell to Europe, our guide to GDPR and email marketing consent.

FAQ

My store is based outside California. Can the CCPA still apply?
The test is whether you do business in California and meet the other conditions, not where you’re based. The official pages don’t define “doing business in California” in detail, so if you sell meaningfully into the state and are near a threshold, get advice.

Do newsletter subscribers count toward the 100,000?
Only if you buy, sell or share their personal information. Collecting emails to send your own newsletter doesn’t, on its own, involve selling or sharing them. Uploading the list to an ad platform for cross-site targeting is the kind of activity to check with your lawyer.

Does using Google Analytics or a similar tool make me covered?
Not by itself. What matters is whether the tool’s use of the data counts as a sale or sharing, which depends on how it’s configured and on your agreement with the vendor, and whether you cross a threshold.

Do I need a cookie banner for California?
The CCPA is built around notice and the right to opt out, rather than the consent-before-cookies model of EU law. If you sell or share, you need the opt-out link and GPC support, and the regulations say a cookie banner alone isn’t an acceptable opt-out method.

Is there still a 30-day cure period?
The Attorney General’s 2022 announcement said the cure provision would expire on January 1, 2023. Don’t count on being given time to fix problems after a notice.

Sources

California Department of Justice, Office of the Attorney General, “California Consumer Privacy Act (CCPA)”: https://oag.ca.gov/privacy/ccpa

Office of the Attorney General, “Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of California Consumer Privacy Act” (August 24, 2022): https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement

California Privacy Protection Agency, “Frequently Asked Questions”: https://cppa.ca.gov/faq.html

California Privacy Protection Agency, “Does My Business Need To Comply With The CCPA?”: https://cppa.ca.gov/pdf/business_comply.pdf

California Privacy Protection Agency, “Updated Monetary Thresholds in CCPA”: https://cppa.ca.gov/regulations/cpi_adjustment.html

California Privacy Protection Agency, “California Consumer Privacy Act of 2018” (statute text): https://cppa.ca.gov/regulations/pdf/ccpa_statute.pdf

California Privacy Protection Agency, CCPA statute and regulations effective January 1, 2026 (including §§ 7012 and 7026): https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf

California Privacy Protection Agency, “CPPA Orders Clothing Retailer Todd Snyder to Pay Six-Figure Fine, Overhaul Privacy Practices” (May 6, 2025): https://cppa.ca.gov/announcements/2025/20250506.html

California Privacy Protection Agency, joint investigative privacy sweep with Colorado and Connecticut (September 9, 2025): https://cppa.ca.gov/announcements/2025/20250909.html