Skip to content
VITI Security
Contact

CCPA / CPRA

CCPA/CPRA Applicability & Exposure Calculator

Check whether the CCPA applies to your business and estimate statutory penalty exposure.

Worldwide annual gross revenue, in millions.

Number of California consumers or households whose personal information you buy, sell or share each year (the statutory volume test counts these, not everyone whose data you hold).

Percentage of annual revenue derived from selling or sharing consumers’ personal information.

Intentional violations - and violations involving personal information of consumers the business knows are under 16 - carry the higher per-violation tier.

How this is calculated

  1. Applicability: the tool runs the three tests in Cal. Civ. Code 1798.140(d) - gross revenue over US$26,625,000 (the US$25 million threshold after the CPPA’s January 2025 inflation adjustment); buying, selling or sharing the personal information of 100,000 or more California consumers or households; or earning 50% or more of revenue from selling or sharing it. Meeting any one is enough.
  2. If none is met, it stops and reports that the law likely does not apply.
  3. Exposure: consumers x US$2,663 per violation (standard) or x US$7,988 (intentional, or involving minors’ data) - the January 2025 adjusted amounts of the US$2,500 / US$7,500 in 1798.155(a) and 1798.199.90(a). The tool assumes one violation per consumer, a worst case; the statute does not say how violations are counted.
  4. Breach damages: consumers x US$107 to US$799, the adjusted statutory damages in 1798.150, shown separately because they apply only to certain data breaches.
  5. The headline is the standard scenario (or the intentional one if you tick that box), with a plus sign because breach damages and other remedies can come on top.

Worked example

The calculator run on its default inputs:

Annual gross revenue
$30 million
California consumers or households
120,000 records
Revenue from selling/sharing personal info
0%
Violations likely intentional (or involving minors)?
No

CCPA/CPRA likely applies - penalty exposure estimated

$319.6M+

Annual gross revenue over $26,625,000 (the $25M threshold as adjusted from Jan 1, 2025)
$30,000,000 → MET
≥ 100,000 CA consumers or households bought, sold or shared
120,000 → MET
≥ 50% of revenue from selling/sharing PI
0% → not met
Standard scenario ($2,663 per violation × 120,000 consumers)
$319,560,000
Intentional / minors scenario ($7,988 per violation)
$958,560,000
Private right of action (breach) - $107-$799 per consumer per incident
$12,840,000-$95,880,000

US$30 million revenue and 120,000 consumers meet two of the three tests. Standard exposure is 120,000 x US$2,663 = US$319,560,000 (shown as $319.6M+); the intentional scenario is 120,000 x US$7,988 = US$958,560,000; breach damages would range from US$12,840,000 to US$95,880,000.

Sources

Sources last checked September 2026.

Limitations

Counting every consumer as a separate violation is the worst case; regulators and courts decide how violations are counted. The tool ignores exemptions (for example data covered by HIPAA or GLBA), the for-profit requirement, and the conditions for breach damages (a qualifying breach of certain data types caused by a failure to keep reasonable security). This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.