---
title: "Decide whether a privacy statute applies to a smaller business"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-a-small-business-whether-the-privacy-act-applies-to-it/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-Y20261018-5-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Decide whether a privacy statute applies to a smaller business

> Put the client's revenue, consumer counts, and "sell or share" percentage into a three-row table against the statutory thresholds. Write no opinion.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-a-small-business-whether-the-privacy-act-applies-to-it/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Put the client's revenue, consumer counts, and "sell or share" percentage into a three-row table against the statutory thresholds. Write no opinion. |
| What the lawyer must review | Civil Code section 1798.140 defines a "business" as a for-profit entity that collects consumers' personal information, determines the purposes and means of processing, does business in California, and meets one of: annual gross revenues over 25 million dollars in the preceding calendar year, as adjusted under section 1798.199.95; alone or in combination, buys, sells or shares the personal information of 100,000 or more consumers or households a year; or derives 50 percent or more of annual revenues from selling or sharing consumers' personal information. Controlled entities with common branding, and certain joint ventures, are brought in by later paragraphs. The Attorney General's FAQ still describes the third threshold as revenue from selling personal information and does not mention sharing. Use the statute. The Attorney General also states that the CCPA generally does not apply to nonprofits or government agencies. Check the adjusted revenue figure before you rely on 25 million dollars. Opinion 512: you sign the advice. |
| Written for | United States |
| Applies to | [Advise a small business whether the Privacy Act applies to it](https://ailawframework.com/practice/privacy-data-protection-and-cyber/advise-a-small-business-whether-the-privacy-act-applies-to-it.md) |

## Checking plan

- What the AI does: Put the client's revenue, consumer counts, and "sell or share" percentage into a three-row table against the statutory thresholds. Write no opinion.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The revenue threshold is adjusted. Open section 1798.199.95 before you quote a dollar figure to the client.
- CCPA coverage is not the only US privacy statute that might apply.

## Sources

- [California Civil Code section 1798.140 (definition of business)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.140.) (checked 2026-10-22)
- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)](https://ailawframework.com/precedents/privacy-data-protection-and-cyber/small-business-exemption-assessment-checklist.md) | Checklist | Yellow | Checklist and advice note on whether a business is a small business operator outside the Privacy Act: the $3 million turnover test, the s 6D(4) exceptions (health services, data trading,… |

Signed-in accounts can read the full text of each one.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*