Even if your SaaS startup is not based in California, it can still be subject to the CCPA if it meets the applicable requirements. What is crucial is not only the location of your business, but whether your business falls under the category of a covered business according to the CCPA.
The California Consumer Privacy Act (CCPA) grants rights to Californian citizens in relation to personal data and imposes duties on certain covered businesses. It is essential for SaaS companies to understand who needs to comply with the CCPA, because customer data might go through various online tools such as websites, applications, CRMs, analytics software, payment systems, and third-party service providers.
In general, the CCPA is applicable to profit-making companies that conduct business in California, handle personal information about California consumers, determine the purposes and means of processing such personal information and satisfy at least one of the statutory thresholds.
The key thresholds are:
This means that the CCPA could also be applicable to entities under control of the covered business and joint ventures.
In regard to SaaS startup companies, the critical point to remember is very straightforward: just because you’re a small company or not based in California doesn’t mean you’re exempt from the CCPA.
The California Consumer Privacy Act, or CCPA, is California’s major consumer privacy law. It gives California residents rights concerning the personal information businesses collect, use, and share about them.
The law was originally enacted in 2018 and was later amended by the California Privacy Rights Act (CPRA). The CPRA amendments became effective January 1, 2023, and the California Privacy Protection Agency (CPPA) now plays a major role in implementing and enforcing the law.
Among other rights, California consumers can have rights to:
This makes CCPA compliance more than simply adding a privacy policy to a website.
One such misconception is the assumption that all companies doing business in California need to adhere to the CCPA.
That is not true. The CCPA usually applies to companies that satisfy certain requirements.
1. For-Profit Businesses That Do Business in California
The CCPA generally applies to for-profit businesses that:
This implies that a business does not necessarily have to have a physical office in California in order to be bound by the CCPA.
For instance, consider a SaaS startup based in Texas selling project management software to businesses all over the U.S. If such a firm has users from California and hits one of the CCPA thresholds, it could be covered by the law.
The Three Main CCPA Thresholds
Understanding the thresholds is one of the easiest ways to determine whether your business may be covered.
Threshold 1: Annual Revenue
Whether or not the CCPA applies to a business depends on whether its gross annual income meets the statutory threshold.
The CCPA threshold for 2025 has been adjusted due to inflation and stands at $26.625 million. It is important to keep in mind that the threshold gets adjusted due to inflation.
Example:
The SaaS firm makes annual gross revenue of $30 million and has a subscription service that is being used by the customers in California.
It doesn’t matter how many customers come from California – if the business meets the applicable revenue threshold and the other requirements for CCPA coverage, it may be subject to the CCPA regardless of the number of California customers.
Threshold 2: Processing Personal Information of 100,000+ Consumers or Households
An organization could also be subject to the CCPA if it buys, sells, or shares the personal information of 100,000 or more California residents or households, subject to the applicable statutory requirements.
This threshold is critical for many SaaS organizations that have large numbers of users.
As an illustration, take into account a free SaaS product that has 150,000 users from California.
While the organization might lack $26.625 million in income, the nature of its activities can imply CCPA applicability.
Threshold 3: 50% or More Revenue From Selling or Sharing Personal Information
Another way that a company could fall under CCPA is if more than half of its yearly revenue comes from selling or sharing the personal information of California residents.
This standard is especially applicable for companies whose business models involve selling or sharing personal information.
While this scenario is probably less applicable to most B2B SaaS startups, it should nevertheless not be overlooked.
Yes, potentially, but not all small businesses are covered by the CCPA.
The size of the organization does not automatically make compliance with CCPA mandatory.
A small SaaS startup may not be covered by the law if it fails to meet certain criteria. Conversely, a small organization may still be subject to the CCPA if it meets the applicable requirements.
Take, for instance, two SaaS startups:
Startup A
It may not meet the main CCPA business thresholds.
Startup B
Its data-processing activities could trigger CCPA coverage even though its revenue is well below the revenue threshold.
The lesson is important: don’t use employee count or startup size as your only compliance test.
For businesses operating under the SaaS model, the first step is to determine whether the business meets the applicable criteria.
If it does, the next step is understanding the practical CCPA requirements for businesses.
Covered businesses may need processes for handling consumer privacy rights, including requests related to:
Businesses should also maintain an appropriate privacy notice and processes for handling consumer requests.
This will entirely depend upon the nature of the business as well as the applicable CCPA requirements.
For a SaaS startup, CCPA compliance isn’t limited to the marketing website.
Personal information can move through the entire technology environment.
A typical data flow might look like:
Each system can create privacy considerations.
1. Map the Personal Information You Collect
Start by identifying what personal information enters your environment.
For example:
The CCPA definition of personal information is broad and can include information that identifies, relates to, or could reasonably be linked with a consumer or household.
2. Understand Why You Collect It
Ask a simple question for every major data category:
Why do we need this information?
If your product gathers data without a clearly defined business rationale, then ask yourself if it is really necessary.
For instance, a software as a service (SaaS) tool for managing projects might require an email address in order to make an account, but gathering additional unnecessary data could create privacy risks.
3. Review Your Third-Party Vendors
SaaS startups rarely operate alone.
They may use:
Review what personal information these vendors receive and understand the contractual and operational relationship between your company and those providers.
The CCPA also establishes separate requirements and definitions concerning service providers and contractors, so vendor management should be part of your compliance program.
4. Build a Consumer Request Process
A customer shouldn’t have to send emails to five different departments to exercise a privacy right.
Create a documented process for:
This becomes particularly important as your startup grows.
Ignoring privacy requirements can create more than a legal problem.
For SaaS companies, poor privacy practices can affect:
Enterprise customers may ask vendors detailed questions about privacy and security during procurement.
A business that cannot clearly explain what personal information it collects, where that information goes, who can access it, and how privacy requests are handled may face greater scrutiny during enterprise sales and procurement.
In other words, CCPA compliance for businesses can become part of the customer experience and sales process, not just a legal requirement.
If your startup may be subject to CCPA, use this checklist as a starting point:
This checklist is a practical starting point, not legal advice. Businesses should obtain qualified legal guidance when determining their specific obligations.
One mistake startups make is treating privacy compliance as a one-time project.
Your data environment changes constantly.
You might:
Each change can affect your privacy posture.
The CPPA’s updated regulations that took effect January 1, 2026 also introduced additional requirements for certain businesses, including requirements related to risk assessments, cybersecurity audits, and automated decisionmaking technologies, with phased compliance timelines for some requirements.
That makes ongoing monitoring increasingly important for growing SaaS companies.
Managing privacy requirements, policies, risks, controls, evidence, and compliance tasks across spreadsheets can become difficult as a SaaS startup grows.
SOCLY.io helps startups bring compliance activities into a more structured and centralized workflow.
With SOCLY.io, teams can:
This can help SaaS companies maintain a more consistent approach to CCPA compliance as their business and data environment grow.
Privacy is not meant to be a one-time project; it is meant to be incorporated into the operations of the business.
This checklist is not a substitute for legal advice.
However, it can provide a useful starting point for building a structured privacy program.
1. Who needs to comply with CCPA?
For-profit businesses that do business in California, collect personal information from California consumers, determine the purposes and means of processing that information, and meet at least one applicable statutory threshold may be subject to the CCPA.
2. Does CCPA apply to small businesses?
Yes, potentially. CCPA applicability is not based solely on the size of a business. A small business may still be covered if it meets one of the applicable statutory thresholds and other requirements.
3. Does CCPA apply to businesses outside California?
Yes, because a company does not have to be situated within California for it to be subject to the law. A business operating outside California but doing its business in California could be subject to the law.
4. What businesses need to comply with CCPA?
Covered entities usually comprise companies that conduct business in California, gather personal data from California residents, control the purposes and means of processing, and meet at least one statutory criterion.
5. Does CCPA apply to SaaS companies?
It could. SaaS firms could fall under CCPA, provided their business operations fit the requirements of the legislation. SaaS firms need to review their users, data flows, income, sharing, and vendors.
6. Do nonprofits have to comply with CCPA?
The CCPA generally applies to qualifying for-profit businesses and does not generally apply to nonprofits or governmental agencies. However, organizations should assess their specific structure and activities to determine whether any provisions apply.
7. Is CCPA compliance the same as GDPR compliance?
No, CCPA and GDPR are distinct legal regimes having their own scope, definition, and requirements. If a company is compliant with CCPA, it cannot be assumed to be compliant with GDPR.
CCPA applicability depends on your company’s structure, activities in California, handling of personal information, revenue, and whether the business meets one or more applicable statutory thresholds.
SaaS companies must realize that waiting for enterprise customers to ask about privacy can create unnecessary challenges.
They should understand what personal information they handle, how it is used, where it is transferred, what consumer rights apply, and whether the CCPA applies to their business.
The privacy program of your company will grow along with it.
Your trusted partner in compliance automation. Turn complex regulations into clear, automated workflows.
By submitting, you agree to our Privacy Policy and Terms of Service
