The CCPA applies to for-profit businesses that collect California residents' personal information and meet one of these thresholds: annual gross revenue over $25M, buy/sell/share personal information of 100,000+ consumers, or derive 50%+ of annual revenue from selling personal information. But even smaller companies can be affected if they handle California consumer data.

The California AG can impose $2,500 per unintentional violation and $7,500 per intentional violation. Under the CPRA amendments, the California Privacy Protection Agency can also bring enforcement actions. With thousands of affected consumers, fines can escalate to millions quickly.

Businesses that sell or share personal information must provide a clear, conspicuous "Do Not Sell or Share My Personal Information" link on their homepage. This link must lead to a functional opt-out mechanism that processes requests without requiring account creation.

GPC is a browser-level signal that communicates a consumer's opt-out preference. Under CCPA/CPRA, businesses must honor GPC signals as valid opt-out requests. Our scanner tests whether your site properly detects and responds to GPC headers.

The full CCPA report includes 12 compliance checks: Do Not Sell discovery, privacy policy depth analysis, consumer rights audit, GPC signal test, cookie disclosure audit, financial incentive audit, minor protection audit, opt-out mechanism test, third-party tracker audit, data collection disclosure check, penalty calculation, and an AI-generated remediation plan. Price: €129.