CPRA

The CPRA applies to for-profit entities that do business in California and satisfy one of the following thresholds:

• Annually buy, sell, or share personal information of at least 100,000 consumers or households, alone or in combination, or
• Derive 50% or more of their annual revenues from selling [or sharing] consumers’ personal information, or

Note: CPRA specifically includes revenue from sharing consumer’s personal information for cross-context behavioral advertising purposes (Cal. Civ. Code § 1798.140(d)(1)(C), (k), (ah) (effective January 1, 2023)).

• Had annual gross revenue exceeding $25 million in the preceding calendar year starting January 1, as adjusted periodically for inflation.
• Persons doing business in California that voluntarily certify to the California Privacy Protection Agency that they will comply with and be bound by the law

CPRA also revises the common branding requirements. (Cal. Civ. Code § 1798.140(d) (effective January 1, 2023).)