CCPA for early-stage startups: thresholds, privacy policies and DPAs

Are you a business under the CCPA?

The CCPA applies to for-profit entities doing business in California that collect consumers' personal information, determine the purposes and means of processing, and meet at least one threshold. The California Privacy Protection Agency lists them as gross annual revenue of $26,625,000 or more in the preceding calendar year, effective January 1, 2025; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling or sharing it.

The revenue figure is adjusted for inflation. The statute requires the agency to adjust it on January 1, 2025 and on January 1 of each odd-numbered year after that, so check the agency's CPI adjustment page in early 2027. Consumers are California residents, and since January 1, 2023 the earlier partial exemptions for employee and business-to-business contact data no longer apply.

Privacy policies come earlier than you think

Even below the CCPA thresholds, the California Online Privacy Protection Act requires an operator of a commercial website or online service that collects personally identifiable information from California residents to conspicuously post a privacy policy. It must describe the categories of information collected and the third parties it may be shared with, among other items.

Once the CCPA applies, the privacy policy must describe consumers' rights, give two or more methods for submitting requests, and be updated at least once every 12 months. The agency's newer regulations on automated decisionmaking technology, risk assessments and cybersecurity audits became effective January 1, 2026, with compliance deadlines phased from 2027.

DPAs and service provider terms

A business that discloses personal information to a service provider or contractor for a business purpose must have an agreement that limits use to specified purposes, requires CCPA compliance and the same level of protection, lets the business take reasonable steps to ensure proper use, and requires notice if the recipient can no longer meet its obligations. That is why enterprise customers send data processing addenda to startups that are not themselves over the threshold.

Example: A B2B startup has $3 million in revenue and 40,000 California users and does not sell or share personal information. It is likely not a CCPA business yet, but it still needs a CalOPPA privacy policy for its website. A large customer that is a CCPA business asks it to sign a DPA as a service provider. The startup should read those terms closely, because it will be bound by them.

Your next steps

1. Check the three CCPA thresholds now and again each January.
2. Post a privacy policy if your website or app collects personal information from Californians.
3. Review customer DPAs against what your product and suppliers actually do.