What is the law actually called now that it was amended?

It is still the California Consumer Privacy Act of 2018, at Civil Code section 1798.100 and following. It was amended, not renamed. Proposition 24, the California Privacy Rights Act of 2020, rewrote large parts of it, and those amendments took effect on 1 January 2023. The Attorney General's office calls the result the CCPA, or the CCPA as amended. The agency posts the statute under the 2018 title, in a version marked effective 1 January 2026. So CPRA compliance and CCPA compliance are the same obligation, and anything that tells you to comply with two separate California statutes is describing one.

Does showing ads in my app count as selling personal data?

Not by itself, and the distinction is in the definitions. A sale means disclosing personal information to a third party for monetary or other valuable consideration. Sharing means disclosing it to a third party for cross-context behavioral advertising, whether or not any money changes hands. Cross-context behavioral advertising is targeting ads using information about the person's activity across apps, sites and services other than the one they meant to use. So an ad SDK that profiles people across other apps is sharing, which carries the same opt-out as a sale. Ads chosen only from what the person does inside your app, with no profile built and nothing passed to a further third party, are nonpersonalized advertising and are neither.

Is the $25 million revenue threshold still right?

The number in the statute is still twenty-five million dollars, but the statute also says that figure is adjusted, and the adjusted figure is the one that binds. Civil Code section 1798.199.95(d) tells the California Privacy Protection Agency to adjust the monetary thresholds on 1 January 2025 and on 1 January of every odd-numbered year after that, using the California consumer price index for all items and all urban consumers, August to August across the prior two years, rounded to the whole dollar and posted by 15 January. The figure in force when this was checked on 10 October 2026 is $26,625,000. The next adjustment is due on 1 January 2027. The record count of 100,000 is not a monetary threshold and does not move with inflation.

What does a covered app have to put in the app itself?

A notice at collection, given at or before the point of collection, and the regulations say that for a mobile application the link to it can sit on the download page and inside the app, such as the settings menu. A privacy policy reachable through a conspicuous link using the word privacy, on the download or landing page, and a mobile app must also link to it from the app's settings menu. Two or more ways to send a request. If you sell or share, either a clear link titled Do Not Sell or Share My Personal Information, or the single alternative link titled Your Privacy Choices with the opt-out icon beside it, or no link at all if you instead honour an opt-out preference signal.

How long do I have to answer a request?

Forty-five days from receiving a verifiable request to know, delete or correct, counted from receipt and not from the point you finish verifying. That window can be extended once by a further 45 days when it is reasonably necessary, provided you give the person notice of the extension inside the first 45 days. A request to opt out of sale or sharing is faster and does not need verifying: you stop as soon as is feasible and no later than 15 business days, and you have to tell the third parties you already sold or shared that person's information to.

Does a free app with no revenue escape the law?

Not automatically, and this is the trap worth knowing. Two of the three thresholds are about money, but the middle one counts records. Buying, selling or sharing the personal information of 100,000 or more consumers or households in a year puts you in scope with no revenue at all, and sharing for cross-context behavioral advertising counts even when no money is exchanged. A free app with an ad SDK that profiles across apps and a six-figure California audience can be a business under this law while earning almost nothing. Contextual ads and a service provider contract with your analytics vendor keep that count at zero.

What happens if a covered app ignores all of this?

The agency can bring an administrative action. The statute sets the fine at two thousand five hundred dollars per violation and seven thousand five hundred for an intentional violation or one involving personal information of a consumer the business actually knows is under 16, as adjusted; the agency's published figures are $2,663 and $7,988, effective 1 January 2025. There is no general right to fix it first. The 30 days of written notice and the chance to cure belong to the private right of action, and that action only covers a breach of unencrypted and unredacted personal information caused by a failure to keep reasonable security. Statutory damages there now run from $107 to $799 per consumer per incident.

Articles · GuidesUpdated October 2026

California's privacy law probably does not cover your app, and the thresholds say so.

The CCPA binds a for-profit business that does business in California and crosses one of three thresholds: revenue above the adjusted figure, which is $26,625,000 today, or buying, selling or sharing the personal information of 100,000 or more consumers or households in a year, or taking half its revenue from selling or sharing personal information. Cross none of the three and the law does not reach you. Most indie apps cross none of them. The one that catches people is the middle one, because it counts records and not money, and because an ad SDK can run that count up on a free app. Every figure and field name below comes from the California Privacy Protection Agency and the California Attorney General, read on 10 October 2026. This sits on top of app security basics.

What follows is who the law covers, what the current statute is called after it was amended, whether advertising is a sale, and what a covered app has to put on screen. Then the part nobody plans for: the threshold you can cross without earning a cent.

Start here

The short version

Three thresholds, any one of them. Miss all three and you are out of scope.

The law is the California Consumer Privacy Act of 2018, at Civil Code section 1798.100 and following. It was amended by Proposition 24, the California Privacy Rights Act of 2020, and those amendments took effect on 1 January 2023. It was not renamed. The agency still posts the statute under the 2018 title. So the CPRA compliance you keep reading about and CCPA compliance are the same job, done once.

Scope is a definition, not a judgment call. You are a business under this law if you are for-profit, you collect California residents' personal information, you decide why and how it is processed, you do business in California, and you cross one of the three thresholds. Nonprofits and government agencies are generally outside it. If you are out, you do not owe a Do Not Sell or Share link, a request process, or a 45 day clock. Say that plainly rather than buying a compliance product you do not need.

Which apps does the California law actually cover?

The definition has two parts and people only read the second one. First you have to be the kind of entity the law speaks to: a for-profit sole trader, partnership, company or other legal entity that collects consumers' personal information, that alone or with others decides the purposes and the means of processing it, and that does business in the State of California. A consumer here means a natural person who is a California resident, including your own employees and job applicants, because the old exemptions for employment data and business to business contacts expired on 31 December 2022.

Then one of three thresholds. Annual gross revenues in the preceding calendar year above the monetary threshold, measured as of 1 January of the year you are in. Buying, selling or sharing, alone or in combination, the personal information of 100,000 or more consumers or households in a year. Or deriving 50 percent or more of annual revenues from selling or sharing consumers' personal information. Any one is enough. Three groups come along for the ride: an entity that controls or is controlled by a business and shares common branding with it, a joint venture in which each business holds at least a 40 percent interest, and anyone who voluntarily certifies to the agency that they will be bound.

The revenue number is the one that has quietly moved. The statute still prints twenty-five million dollars, with a footnote saying the amount has been updated. Civil Code section 1798.199.95(d) requires the agency to adjust the monetary thresholds on 1 January 2025 and on 1 January of every odd-numbered year after, using the California consumer price index for all items and all urban consumers, the August to August change across the prior two years, rounded to the nearest whole dollar and posted on its website by 15 January. The figure in force when this page was written on 10 October 2026 is $26,625,000. Expect another one on 1 January 2027. The 100,000 record count is not monetary and does not move.

Worth knowing before you trust a number you read somewhere: the two state websites do not agree. The agency lists the adjusted $26.625 million. The Attorney General's page still says over $25 million. The statute is the one that tells the agency to publish the adjustment, so the agency's figure is the operative one, and the gap between the two pages is a good reason to check the source rather than a summary. Asked directly whether the law applies to a small business, the agency's answer is to go back and read the thresholds. There is no small business exemption hiding behind them.

California Privacy Protection Agency, frequently asked questions, read 10 October 2026

Check yours

Is your app in scope today?

Both of the first two have to be true. Then any one of the three thresholds puts you in scope. This is the test from the definition of a business, not legal advice.

Both of these

Then any one of these

Out of scope so far. A nonprofit app, or a business that does no business in California, is not a business under this law, whatever the data looks like.

The thresholds are read as of 1 January of the year you are in, on the preceding calendar year.

Does showing ads in your app count as selling data?

No, and yes, and the answer turns on two separate definitions. A sale is disclosing, releasing, making available or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration. Sharing is disclosing it to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, and the statute spells out that it includes arrangements in which no money is exchanged. Both carry the same consumer right to opt out. So an ad deal can trigger the law without a single invoice.

Cross-context behavioral advertising is the targeting of advertising based on personal information obtained from the person's activity across businesses, distinctly branded websites, applications or services other than the one they intentionally interact with. Read that against a mobile ad network and the answer falls out. If the SDK uses the advertising identifier to build a picture of what someone does in other apps, and targets on that, you are sharing. The opposite case is defined too. Nonpersonalized advertising is advertising based solely on personal information derived from the person's current interaction with your business, with precise geolocation excluded. The regulations treat it as a short-term transient use, provided the information is not passed to a further third party and is not used to build a profile or alter the experience outside that interaction.

Who counts as a third party matters just as much. A third party is anyone who is not you, not a service provider and not a contractor. Your analytics vendor, under a written contract that bars it from selling the data, from using it for anything beyond your instructions and from combining it with data from its other customers, is a service provider, and handing it data is not a sale or a share. The same vendor without that contract is a third party. The contract is the whole difference, and it is the cheapest piece of compliance you will ever buy. If you are already wiring up consent for the advertising identifier, that work overlaps with app tracking transparency on iOS, though the two regimes ask different questions.

Two carve-outs stop honest apps from tripping. It is not a sale or a share when the person uses or directs you to disclose their information or to interact with a third party, so a share sheet or a deliberate export is fine. And it is not a sale when personal information moves as an asset in a merger, acquisition or bankruptcy, as long as the use stays consistent with the law. What you cannot do is call something contextual while an identifier goes out of the building.

California Office of the Attorney General, California Consumer Privacy Act, read 10 October 2026

What has to be in the app if you are covered?

Start with the two notices, because the regulations say where they go in a mobile app rather than leaving it to taste. The notice at collection has to reach the person at or before the point you collect their information, and if you do not give it, you may not collect. In an app you can put a link to it on the download page and inside the app, for example in the settings menu. The privacy policy has to be reachable through a conspicuous link using the word privacy, on the download or landing page, and a mobile app must also link to the policy from the app's settings menu. It also has to be printable as a document.

Then the opt-out, but only if you sell or share. The statute gives three ways to do it. A clear and conspicuous link titled Do Not Sell or Share My Personal Information, plus a second link titled Limit the Use of My Sensitive Personal Information if you use sensitive information beyond the permitted purposes. Or one combined link, titled Your Privacy Choices or Your California Privacy Choices, with the agency's opt-out icon next to it. Or neither, if you instead honour an opt-out preference signal sent on the person's behalf by a platform or mechanism, which the agency names the Global Privacy Control as an example of. Note the shape of that last one: it is built for businesses collecting information online, and the new browser duty in the statute lands on whoever makes the browser, not on you.

Then the request machinery. Two or more designated methods for sending a request. Forty-five days to disclose, correct or delete after a verifiable request, counted from when the request arrives rather than from when you finish verifying, extendable once by another 45 days when that is reasonably necessary and you say so inside the first 45. An opt-out does not need verifying at all: stop selling and sharing as soon as is feasible and no later than 15 business days, and notify the third parties you already passed that person's data to. Sensitive personal information has its own list, which now includes precise geolocation, account credentials, and neural data.

None of this is the store paperwork, and they are easy to confuse. The data types you write down here are the same data types you will declare as App Store privacy details, so do the inventory once and spend it twice. But Apple and Google ask you to describe what you collect. California asks you to let people act on it. An app can pass review with a perfect declaration and still owe somebody a deletion.

California Privacy Protection Agency, frequently asked questions, read 10 October 2026

What if you are under every threshold?

Then the law does not oblige you, and you should not pretend otherwise. No Do Not Sell or Share link, no request process, no 45 day clock. A small paid app with a few thousand users, no ad network and no data sales is simply not a business under this statute. The useful move is to write down why, with the date and the three thresholds beside your own numbers, and keep the note. It takes ten minutes and it answers the question the next time a customer, an investor or a procurement form asks it.

Three things still catch out-of-scope apps. The first is the volume threshold, which is the only one you can cross without money. Add a behavioural ad SDK and a hundred thousand California users, and you are sharing at scale on a free app. The second is that being out of scope as a business does not help if you are inside somebody else's compliance: service providers and contractors to covered businesses carry their own duties, so your B2B app can inherit contract terms it has to honour. The third is the data broker regime, which is a different registration and applies if you knowingly collect and sell personal information about people you have no direct relationship with.

Other rules are untouched by any of this. Apple and Google both want a privacy policy and a privacy declaration before you can publish, whatever your revenue. A European user brings GDPR for an app with them, and it has no revenue threshold at all, which is why plenty of apps are out of scope in California and in scope in Europe. Several other American states have their own consumer privacy statutes with their own numbers. California is the loudest, not the only one.

And the cheap habits are worth keeping even when nothing compels them. Keep the app local-first for as long as the product allows. Put your analytics vendor on a service provider contract on day one. Prefer contextual ads to behavioural ones until the revenue gap is real money. Each of those keeps you under a threshold rather than arguing about one, and each one is less work before launch than after.

California Office of the Attorney General, California Consumer Privacy Act, read 10 October 2026

Six things an app does, and which of them is a sale

Read down the rows rather than reasoning from the word selling. Three of the six need no opt-out route at all. Of the three that do, only one involves being paid, which is why reading the word selling literally gets people the wrong answer.

What the app does	A sale	Sharing	Needs an opt-out route
An ad SDK that targets using behaviour from other apps	No	Yes	Yes
Ads based only on what the person does in your app	No	No	No
Selling an email list to a partner for money	Yes	No	Yes
Analytics vendor under a service provider contract	No	No	No
A data swap that feeds someone's ad profiles, no money paid	Only if value comes back	Yes	Yes
The person taps a button to send data to another app	No	No	No

Where this lands if a builder generated your app

Nothing in the definition of a business mentions who wrote the code. The entity that ships the app decides why and how the data is processed, so the entity that ships the app is the one the law looks at. An AI builder does not become a joint controller of your users, and it does not become your service provider for the data your app collects either.

Newly is an AI app builder. You describe an app in plain English and it writes a real React Native and Expo project that you own. It runs the app on cloud iOS and Android simulators while it builds, uploads iOS builds to TestFlight, publishes to Google Play internal testing and can build a standalone Android APK, and keeps two-way GitHub sync so the code is never hostage. It is $25 a month and there is no free tier. It does not submit to the App Store for you, because Apple requires the owner of the content to submit.

The useful part here is where a generated app starts. A new project is local-first: data on the phone, no accounts, no server, no ad network. On this law's test that is nothing sold, nothing shared, and nothing counting toward 100,000 records. That changes the moment you ask for accounts, sync or payments, because the agent then adds a backend with sign-in, an API, a Postgres database and file storage, and data starts leaving the device. Ask for ads and you have a third party to classify. The honest limit: generating an app does not tell you which side of a threshold you are on. Only your own numbers do.

Questions people ask about the CCPA and mobile apps

Only if the business behind the app meets the definition of a business in the law. That means a for-profit entity that collects California residents' personal information, decides why and how it is processed, does business in California, and crosses one of three thresholds: gross revenue above the adjusted figure the agency publishes, which is $26,625,000 and was read on 10 October 2026; buying, selling or sharing the personal information of 100,000 or more consumers or households in a year; or taking 50 percent or more of annual revenues from selling or sharing personal information. Most small apps hit none of the three and are out of scope. The agency's own answer to the small business question is to read the thresholds again, because there is no separate small business carve-out.

Build the app first, then read your own numbers

Start local-first, keep the data on the phone while you find out whether anyone wants the thing, and add the server only when the product needs it. You will know exactly what you collect, which is the only honest way to answer any of this.

Start building