Does CCPA Apply to My Website? (2026 Guide + Free CCPA Compliance Checker)
The California Consumer Privacy Act (CCPA) — updated as CPRA in 2023 — applies to millions of websites that collect data from California residents. Here's how to know if you're covered and how to check your compliance for free.
If your website serves users in California, you've probably wondered whether the California Consumer Privacy Act applies to you. The answer depends on a few specific thresholds — and the stakes are real: violations can cost up to $7,500 per intentional violation. AuditAI includes a free CCPA compliance scanner as part of its website audit — no login required.
What Is CCPA / CPRA?
The California Consumer Privacy Act (CCPA), strengthened by the California Privacy Rights Act (CPRA) in 2023, gives California residents the right to:
- Know what personal data is collected about them
- Delete their personal data
- Opt out of the sale or sharing of their personal data
- Correct inaccurate personal data
- Limit the use of sensitive personal information
- Not be discriminated against for exercising these rights
Unlike GDPR (which applies to all EU data), CCPA only applies to businesses that meet certain size thresholds. But those thresholds are lower than most people assume.
Does CCPA Apply to My Website?
CCPA applies to your business if it is for-profit, does business in California, and meets at least one of these thresholds:
Annual gross revenue over $25 million
Applies regardless of how much California data you process
Buy, sell, or share personal data of 100,000+ California consumers or households per year
This threshold catches many SaaS, analytics, and ad-supported sites
Derive 50%+ of annual revenue from selling or sharing California consumers' personal information
Primarily catches data brokers and ad networks
Important note for small businesses
If your website uses third-party analytics (Google Analytics), advertising pixels (Meta, Google Ads), or sells user data to data brokers, the second threshold (100,000 consumers) may apply even if you're a small business. Every unique visitor who lands on a page with a tracking pixel is potentially counted.
What Does CCPA Compliance Require for Websites?
If CCPA applies to your website, here's what you must have in place:
Privacy Policy
Must disclose categories of personal data collected, purposes, and consumer rights. Must be updated annually.
"Do Not Sell or Share My Personal Information" link
Must be prominently displayed on your homepage and any page where data is sold/shared.
Opt-out mechanism
Users must be able to opt out of the sale or sharing of their data without having to create an account.
Data deletion request process
You must respond to deletion requests within 45 days.
Data portability
Consumers can request their data in a portable format.
Non-discrimination clause
You cannot penalise users who exercise their CCPA rights.
How to Check if Your Website is CCPA Compliant (Free)
The quickest way to check your website's CCPA compliance is to run a free scan at auditai.fyi. AuditAI's compliance checker — no email required — scans for:
- Presence of a privacy policy link
- HTTPS enforcement (required for secure data handling)
- Third-party tracking script detection
- Cookie consent mechanism presence
- Data exposure signals
AuditAI checks CCPA alongside GDPR (EU) and India's DPDP Act in a single scan — making it one of the only free CCPA compliance scanner tools that covers all three major frameworks at once.
CCPA vs GDPR: What's the Difference?
| Feature | CCPA / CPRA | GDPR |
|---|---|---|
| Applies to | For-profit businesses in California meeting thresholds | Any organisation processing EU residents' data |
| Opt-in required? | No — opt-out model | Yes — prior consent required |
| Data deletion | Yes — 45-day response | Yes — 30-day response |
| Penalties | Up to $7,500 per intentional violation | Up to €20M or 4% of global revenue |
| Cookie consent banner | Not explicitly required | Required before non-essential cookies |
Check Your CCPA Compliance Free
AuditAI scans for CCPA, GDPR, and DPDP compliance signals in a single free website audit — no login required. Get instant results with AI-generated recommendations in under 30 seconds.
Run Free Compliance Check →