Reviving this thread with a 2026 update that is relevant for small businesses. The California Privacy Protection Agency (CPPA) finalized its updated regulations in late 2025, and there are a few developments worth tracking.
First, the CPPA has begun issuing enforcement advisory letters to businesses that clearly meet the thresholds but lack basic compliance measures. These are not formal enforcement actions, but they signal that the agency is actively monitoring. Several small e-commerce companies in the 1-5M revenue range have received these letters, particularly those using aggressive retargeting and data enrichment services.
Second, the Global Privacy Control (GPC) signal is now mandatory to honor under the CPRA regulations. If your website detects a GPC signal from a browser, you must treat it as a valid opt-out of sale and sharing. Most major browsers now support GPC. If you are running Shopify with third-party analytics, ad pixels, or customer data platforms, you need to ensure your consent management platform respects GPC signals. Failure to honor GPC has been cited in multiple CPPA enforcement actions.
Third, the data broker registration requirement under the Delete Act (SB 362) now carries significant penalties for non-registration. If your business buys, sells, or shares personal information of consumers with whom you do not have a direct relationship, you may qualify as a data broker under the expanded definition. This catches some affiliate marketing and lead generation businesses off guard.
My recommendation for small e-commerce businesses: even if you are below the CCPA thresholds, implement a privacy policy, a cookie consent banner that respects GPC, and a process for handling data deletion requests. The cost is minimal compared to the risk, especially since five other states now have comprehensive privacy laws with lower thresholds than California.