Assess CCPA/CPRA compliance for California consumer privacy. Evaluate disclosure, opt-out, and deletion requirements.
You answer a short questionnaire about your business - annual revenue, how many California consumers' personal information you buy, sell, or share per year, whether you post a privacy notice at or before collection, and how you handle consumer requests - and the tool maps your answers against the CCPA as amended by the CPRA, telling you whether the law applies to you and which obligations are unmet. Everything runs in your browser; nothing you enter is uploaded. The surprise for most people: being under $25 million in revenue does not automatically exempt a business.
A concrete input and expected output from the current implementation.
Input
Revenue: $12 million per year. Personal information bought from 200,000 California consumers per year. Sells or shares personal information: no. Revenue from selling or sharing: 0%.
Expected output
Covered. Prong 1 (revenue over $25 million): not met. Prong 3 (50% of revenue from selling or sharing): not met. Prong 2: met - the business annually buys personal information of 100,000 or more California consumers (200,000), which qualifies it under Civil Code section 1798.140. Result: notice at collection, access, deletion, and correction requirements apply; the 'Do Not Sell or Share' opt-out requirement does not, because the business neither sells nor shares.
The three prongs of the business definition are alternatives, so coverage does not require $25 million in revenue. Because 200,000 exceeds the 100,000-consumer threshold, the business qualifies, while the opt-out duty drops out since it applies only to selling or sharing.
The tool first tests the three prongs of the statutory definition of 'business' in California Civil Code section 1798.140: annual gross revenues over $25 million; annually buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or deriving 50 percent or more of annual revenue from selling or sharing. Meeting any single prong qualifies the business, and the rest of the assessment assumes coverage.
For a business that qualifies, the tool walks through the operational requirements: a notice at or before collection describing categories collected, purposes, and rights; procedures for verifiable consumer requests covering access, deletion, correction, and opt-out of sale or sharing, with the 45-day response clock and one 45-day extension; non-discrimination against consumers who exercise rights; and written contracts with service providers and contractors. Each is marked met, missing, or not applicable.
Yes, and this is the most common misconception the tool corrects. The revenue test is only one of three prongs. You are also covered if you annually buy, sell, or share the personal information of 100,000 or more California consumers or households, or if 50 percent or more of your annual revenue comes from selling or sharing consumers' personal information. Fill in all three questions, not just revenue.
No. The assessment runs entirely in your browser and the answers are processed locally, so nothing is uploaded by the tool. You can therefore answer with real revenue and volume figures without creating a record on a server. If you want to keep the results, copy or export them yourself before leaving the page.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.