A two-store bike shop in Fresno with a loyalty list of 4,000 email addresses. A Sacramento hardware store running a Shopify site with a Meta pixel bolted onto it. Neither has a privacy team, a general counsel, or a line item for compliance. Do they need to worry about the California Consumer Privacy Act?
Sometimes yes, sometimes no — and the answer rarely turns on how big the shop is. It turns on a few thresholds, on how you actually use customer data, and on what your vendors ask you to sign. Here is a workable way to figure out where you stand and what to do about it.
Does the CCPA apply to a shop your size?
The law reaches for-profit businesses that do business in California and meet at least one of three tests:
- Annual gross revenue above roughly $25 million. The exact figure is adjusted for inflation periodically, so confirm the current number rather than relying on the original amount.
- Buying, selling, or sharing personal information of 100,000 or more California consumers or households in a year — the count is also adjusted over time.
- Earning 50 percent or more of annual revenue from selling or sharing consumers' personal information.
Many small retailers miss all three. If that is you, you are not a "business" under the CCPA, and the direct obligations below do not fall on you. Two caveats matter, though. First, if you act as a service provider or contractor for a larger company, you will be handed contract terms to sign and you will be expected to help that company honor deletion and access requests. Second, several other states now have consumer privacy laws with their own thresholds, and California has older statutes on the books as well.
And be careful with the word "sell." A lot of owners say "we don't sell data" and mean it — yet the CCPA's definition can capture a loyalty program that trades discounts for personal information, and "sharing" separately covers handing data to ad networks for cross-context behavioral advertising. A remarketing pixel on your product pages is the most common example in small retail.
Map your data before you write a single policy
Policies written from a template are the ones that get stores in trouble, because they promise things the business does not do. Spend an afternoon on a spreadsheet instead. For each place you collect information, write down four columns: what you collect, why you collect it, where it is stored, and who else receives it.
For a typical retailer that list includes point-of-sale transactions, loyalty sign-ups, email and SMS marketing, returns and warranty records, e-commerce order data, website analytics and advertising cookies, in-store Wi-Fi logins, gift card records, job applications, and security camera footage. Mark anything that is sensitive personal information — precise geolocation, government identifiers, financial account credentials, health data — because it carries extra obligations. Nobody outside your shop needs to see this spreadsheet. It just has to be accurate, because every disclosure you publish and every request you answer depends on it.
The disclosures customers actually see
Your privacy policy
The policy must describe the categories of personal information you collect, the purposes, the categories of third parties who receive it, how long you keep it, and how a consumer can exercise their rights. It also has to be reviewed and updated at least every twelve months. Put a real review date on your calendar, not a note that says "eventually."
Notice at collection
This is the short notice given at or before the moment you collect information: on the web checkout page, on the loyalty enrollment form, at the register when a cashier asks for a phone number. It states the categories collected and the purposes, and points to the full policy. Cashiers and floor staff need a one-sentence script so the notice is actually delivered.
Do Not Sell or Share My Personal Information
If you sell data, share it for targeted advertising, or use sensitive information beyond permitted purposes, you need the corresponding opt-out link in your website footer and a way to honor it. Regulators allow a single combined link — "Your Privacy Choices" with the standard opt-out icon — which is far less confusing for customers. You are also expected to honor opt-out preference signals such as the Global Privacy Control that browsers and extensions send automatically. If you ever wondered why a cookie banner matters more in California than elsewhere, this is why.
Handling requests without creating chaos
Consumers can ask to know what you hold, get a copy, have it corrected, or have it deleted. Build one process and reuse it:
- Offer at least two ways to submit a request, including a toll-free number if you have one, plus a web form or email address.
- Confirm receipt within ten business days and log the request the same day.
- Verify identity before disclosing or deleting anything — match against data you already hold, and never ask for more than you need to verify.
- Respond substantively within 45 calendar days. If you need more time, tell the consumer and take one additional 45-day period.
- When you delete, pass the request to your service providers and contractors and confirm they deleted too.
- Keep records of requests and responses for at least 24 months.
- Never punish someone for asking. Refusing a discount, denying a return, or downgrading service because a customer exercised a right is itself a violation.
Vendors, loyalty programs, and staff data
Your email platform, payment processor, e-commerce host, and analytics provider are probably service providers. Each relationship needs a written contract with the required privacy clauses, including limits on how they use your customer data and a duty to help you comply with deletion requests. If a vendor refuses to sign, treat that as a reason to look at alternatives.
Loyalty and rewards programs deserve a second look, since a discount in exchange for personal information can be a sale or a financial incentive. That typically means a separate notice explaining the program and a good-faith estimate of what the data is worth to you. Employee and job-applicant data has been covered since 2023, so your HR files are in scope too.
One more reason not to treat this as paperwork: California gives consumers a private right of action after certain data breaches, and enforcement penalties can run into thousands of dollars per violation. The mandatory 30-day cure period is gone, so "we'll fix it if someone complains" is not a strategy.
A practical starting point
Week one: confirm whether you meet a threshold and complete the data map. Week two: fix the privacy policy and the notice at collection. Week three: set up the request intake channel and train staff on it. Week four: review vendor contracts and your ad pixels. Then diarize an annual review.
Two smaller habits make all of this stick. Collect less — if you have no use for a customer's birth date, stop asking for it. And keep the same discipline for every state law that reaches you, since the underlying work is nearly identical.
The CCPA has real teeth, and the details shift as regulations are updated. If your revenue is close to a threshold, if you run a loyalty program, or if you sell to other businesses that demand contractual promises from you, have a California-licensed attorney who handles privacy review your setup before you publish anything.
Photo: konkapo / Pixabay
