[konne88]

But it also doesn't apply to small companies:

The CCPA applies to any business, including any for-profit entity that collects consumers' personal data, does business in California (regardless of where it is located), and satisfies at least one of the following thresholds:

Has annual gross revenues in excess of $25 million in its most recent tax year;[11] Buys, receives, or sells the personal information of 100,000 or more consumers or households; or Earns more than half of its annual revenue from selling consumers' personal information.[12][13]

https://en.wikipedia.org/wiki/California_Consumer_Privacy_Ac...

[petcat]

Right, the CCPA targets large/semi-large scale data processors. That Wikipedia seems to be outdated, because the law text reads:

> satisfies one or more of the following thresholds:

> (A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185.

> (B) Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.

> (C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information.

This alone is enough to apply to most non-trivial apps/businesses where large-scale data harvesting is a huge problem:

> the personal information of 50,000 or more consumers, households, or devices.