CCPA and State Privacy Laws for Local Business Marketing

Key Takeaways

• CCPA applicability is based on meeting specific thresholds (revenue, data volume, or data-sale percentage), not simply operating in or near California.
• A growing number of states beyond California have their own comprehensive privacy laws, each with its own thresholds and requirements.
• A business can be subject to more than one state’s privacy law at the same time if it has customers across state lines.
• This article provides general information, not legal advice — confirm specific obligations with a qualified attorney.

How CCPA Applicability Actually Works

CCPA doesn’t apply to every business that has a California customer — it applies to businesses that meet specific thresholds, which generally relate to annual revenue, the volume of California consumers’ data processed each year, or a meaningful share of revenue coming from selling personal information.

A small local business with a handful of California customers and no data-selling activity may well fall under these thresholds and not be directly subject to CCPA’s full requirements. A business with a larger customer base, significant online marketing reach, or any activity that counts as a data “sale” under CCPA’s broader definition of that term is more likely to meet the threshold. Because the specific dollar and volume figures can be updated, confirming current thresholds against the law’s actual text (or with legal counsel) is more reliable than relying on a fixed number that may become outdated.

What “Sale” Means Under CCPA — Broader Than It Sounds

One of the most common points of confusion is CCPA’s definition of “selling” personal information, which is broader than an everyday business transaction and can include certain types of data sharing with advertising or analytics partners, even without an exchange of money.

Common Marketing Activity	Could Count as a “Sale” Under CCPA?
Sharing customer data with an ad platform for targeted advertising	Often yes, depending on the specific arrangement
Using a third-party analytics tool that receives customer data	Can, depending on how the data is used by that third party
Simply using a CRM to manage your own customer list	Generally no — using your own data internally isn’t a sale
Selling a customer list to another business for compensation	Yes, clearly

This broader definition is part of why a business might trigger CCPA applicability through data-sharing practices even if it never directly sells customer lists in the traditional sense — reviewing how marketing and advertising tools use shared data is a meaningful part of determining actual exposure.

Beyond California: Other State Privacy Laws

CCPA was the first comprehensive state privacy law in the U.S., but it’s no longer the only one — a number of other states have since enacted their own versions, each with somewhat different thresholds and specific requirements.

A local business marketing to customers across multiple states should review whether any of these other state laws apply based on where its customers are located, not just where the business itself operates. The general categories of rights (know, delete, opt out of sale/sharing) tend to be similar across these laws, but the specific thresholds, exemptions, and enforcement mechanisms differ enough that a business subject to multiple laws needs to account for each one’s specific requirements rather than assuming compliance with one covers all of them.

A Practical Applicability Self-Check

Before assuming a privacy law does or doesn’t apply, work through these questions:

1. Where are your customers located? Not just where your business operates, but where the individuals whose data you hold actually reside.
2. What’s your approximate annual revenue? Compare against the relevant threshold for each state where you have customers.
3. How many individual consumers’ data do you process annually? Some thresholds are based on volume rather than revenue.
4. Do you share customer data with any advertising, analytics, or AI tool that could count as a sale or share under a relevant law’s definition?

Answering these questions honestly — and confirming the answer against the current, specific text of each relevant law or with legal counsel — is the reliable way to determine actual obligations, rather than assuming either blanket exemption or blanket coverage based on business size alone.

What to Do Once You Know Which Laws Apply

If a review determines that one or more state privacy laws apply to your business, the practical next steps are the same regardless of which specific law is involved: build a data inventory, define a retention policy (covered in data retention policies for local business CRM systems), and update your privacy policy to accurately reflect your data practices, including any AI tools involved in marketing (covered in building a privacy policy for AI-powered local business marketing).

Get Clarity on Your Compliance Obligations

Understanding which privacy laws actually apply to your business is the first step toward a defensible marketing data practice. See our local business services to review your CRM and marketing data practices as part of a broader compliance-aware setup.

Why This Deserves a Periodic Re-Check

Applicability isn’t a one-time determination — a business’s revenue can grow past a threshold, a new state law can take effect, or a new marketing tool can introduce a data-sharing arrangement that wasn’t part of the original assessment. Revisiting this applicability self-check roughly once a year, or whenever a significant change occurs (entering a new state’s market, adopting a new advertising or AI tool, a meaningful revenue change), keeps the assessment current rather than relying on a determination made years earlier under different circumstances. Businesses growing quickly are particularly worth watching here, since crossing a revenue or data-volume threshold can happen faster than a periodic compliance review might otherwise catch.