CCPA and CPRA are the same law, amended
The California Consumer Privacy Act (CCPA) was the original 2018 law. The California Privacy Rights Act (CPRA), passed in 2020, amended and expanded it — added new consumer rights, created the California Privacy Protection Agency (CPPA) to enforce it, and took full effect in 2023. People still say "CCPA" out of habit, but in practice you're dealing with one law, CCPA as amended by CPRA, enforced by the CPPA. It's a California state law, distinct from and not affiliated with the EU's GDPR — a site can be subject to one, both, or neither, depending on whose data it processes and how big the business is.
The actual applicability thresholds
This is the part that gets skipped in most "is my site compliant" checklists, and it's the one that matters most: CCPA doesn't cover every business that collects a California visitor's email address. Per the California Attorney General's own CCPA guidance, a for-profit business is only covered if it does business in California and meets at least one of these three thresholds:
- Annual gross revenue over $25 million — this figure is adjusted for inflation periodically; by 2026 the effective threshold is somewhat higher than the original statutory $25M as published by outside compliance trackers, but $25M is the number written into the law and the one the AG's office cites directly.
- Buys, sells, or shares the personal information of 100,000 or more California residents or households per year — note this is about the volume of California consumers' data you handle, not your total traffic or total user base.
- Derives 50% or more of annual revenue from selling or sharing California residents' personal information — this one is aimed squarely at data brokers and ad-tech businesses, not typical site owners.
If your business doesn't clear any of these three bars, CCPA simply does not apply to you as a business, regardless of how much personal data your WordPress site technically collects. This is a deliberate design choice in the law — it's built to exempt small businesses, not to catch every blog with a comment form or every WooCommerce store with a mailing list. A solo consultant's WordPress site, a small local shop's WooCommerce store, or a niche blog with a newsletter almost never meets any of these thresholds on its own.
Where it gets less obvious: revenue and data-volume thresholds are evaluated at the business level, not the website level. A small-looking site that's one property of a larger company, or that shares infrastructure/data with a parent business that does meet the thresholds, may still be covered even though the site itself looks modest. If you're not sure which side of that line you're on, that's exactly the kind of question worth an actual legal opinion rather than a guess.
What rights CCPA gives covered users
If your business is covered, California residents get a specific, enumerated set of rights over their personal information, per the AG's guidance:
- Right to know — what personal information you've collected, where it came from, what you use it for, and who you've shared it with (a resident can ask for this up to twice a year, free of charge).
- Right to delete — request that you delete personal information you've collected about them, subject to specific legal exceptions.
- Right to correct — request that you fix inaccurate personal information you hold about them.
- Right to opt out of sale/sharing — direct you to stop selling or sharing their personal information, including honoring signals like Global Privacy Control.
- Right to limit use of sensitive personal information — restrict use of things like precise geolocation, government ID numbers, or financial account details to narrower, specified purposes.
There's also a right to non-discrimination — you can't punish someone with a worse price or service for exercising any of the above.
What actually changes on a covered WordPress/WooCommerce site
If your business does clear one of the thresholds, the technical implications for a WordPress site are fairly concrete rather than abstract:
- A "Do Not Sell or Share My Personal Information" mechanism — typically a visible link plus honoring the Global Privacy Control browser signal, if you engage in anything that counts as "selling" or "sharing" data (this includes some ad-tech and analytics integrations, not just literal data sales — worth checking with counsel if you run third-party ad pixels).
- A privacy policy that actually describes your practices — categories of data collected, purposes, retention, and third parties — reviewed at least annually.
- A working process to honor know/delete/correct requests — someone needs to actually be able to pull a WooCommerce customer's order history, comment history, and account data and act on it within statutory timeframes. This overlaps heavily with the export/erasure tooling already built into WordPress core and WooCommerce for GDPR-style requests — see our guide on securing WooCommerce customer data for where that data actually lives.
- Verifying the requester's identity reasonably before acting on a request, so you're not handing someone else's order history to whoever emails in claiming to be them.
None of this is something a security plugin does for you automatically. A plugin can help with the security side that supports compliance — access control, audit trails of who touched customer data and when, detecting unauthorized data exports — but the legal determination of whether you're covered, and the actual privacy-policy and consumer-request process, is a business and legal decision, not a technical one.
The honest bottom line
Most small WordPress sites and stores never meet any of the three CCPA thresholds and have no CCPA obligations at all, beyond general good practice around handling customer data responsibly. If your business is larger, handles data at meaningful scale, or is part of a bigger company that clears these thresholds, this isn't optional and the details are specific enough that a compliance checklist can't replace an actual legal review.
Whatever your compliance status, know what's actually happening on your site first.
Install free →