What CCPA compliance actually costs a small business
For a small business that has just crossed a California threshold, the honest planning answer is low tens of thousands of dollars in the first year, and roughly a third to a half of that every year afterwards. The worked example below — a 62-person online retailer holding personal information on 138,000 California consumers — comes to $41,800 in year one and a $16,300 annual run-rate. Almost none of that is a fine, a lawyer or a software licence. It is the cost of knowing where your data is and being able to act on a request within a deadline, which is why the number tracks the messiness of your systems far more closely than it tracks your revenue.
First, check whether the law reaches you at all
The most expensive mistake in this area is budgeting for a regime that does not apply to you; the second most expensive is assuming it does not. The CCPA, as amended by the CPRA, reaches a for-profit entity doing business in California that meets at least one published threshold: annual gross revenue above the statutory figure (set at $25 million and periodically adjusted), or annually buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.
Two features of that test drive cost in ways a revenue-based intuition misses. The first is that the record-count threshold counts consumers and households, not customers — a household counts once, and identifiers you never think of as customer data can count toward it. The second is that the third limb catches businesses whose revenue is small but whose model is built on sharing data, which is how a modest advertising-supported operation ends up covered while a larger conventional retailer is not. Check the current adjusted figures against the California Privacy Protection Agency and the California Attorney General’s privacy pages before building a budget on them. None of this is legal advice, and applicability to your particular facts is exactly the sort of question that warrants counsel.
Where the money actually goes
Compliance cost decomposes into eight recognisable lines. The figures below are indicative planning ranges for a small business with a handful of systems holding personal information — not a benchmark drawn from a published survey, and not a quote. Use them the way you would use a first-pass estimate on any project: to see the shape of the spend and find the lines worth attacking.
| Cost line | First year | Annual after |
|---|---|---|
| Data inventory and mapping | $6,400 | $1,200 |
| Privacy policy and notice-at-collection rewrite | $3,800 | $700 |
| Consumer-request intake and fulfilment workflow | $5,900 | $4,100 |
| Opt-out mechanism and browser signal handling | $4,200 | $900 |
| Service-provider contract amendments | $7,300 | $1,450 |
| Staff training and internal process | $2,750 | $1,900 |
| Records retention and request logging | $2,100 | $1,650 |
| Risk assessment and annual programme review | $9,350 | $4,400 |
| Total | $41,800 | $16,300 |
Notice what dominates. The two largest first-year lines — mapping and the annual review — produce no customer-visible artefact whatsoever, while the line most people picture when they hear “CCPA compliance”, the privacy policy, is the fourth smallest. The programme is mostly an inventory exercise wearing a legal hat.
A worked example: the 62-person retailer
Our retailer sells direct to consumers nationally, holds personal information on 138,000 California consumers, and uses eleven third-party services that touch customer data: a payment processor, an email platform, a helpdesk, an analytics suite, a reviews widget and six smaller integrations. It crosses the 100,000-record threshold comfortably. Revenue is $19.4 million, below the revenue limb — which is precisely the situation in which a business assumes it is out of scope and is not.
Two of the lines above are worth tracing to their drivers, because they are the two that scale with the business rather than sitting flat.
Request handling. Observed request rates at consumer-facing businesses cluster well under one percent of the eligible population per year. At 0.08% of 138,000 consumers the retailer should plan for roughly 110 requests a year. At a fully loaded $37 per request — the figure it reaches once mapping is done and most requests can be answered from four known systems instead of eleven unknown ones — that is $4,070, essentially the whole $4,100 run-rate line. Before mapping, the same 110 requests were costing an estimated $128 each, or $14,080 a year. The $6,400 mapping line pays for itself in under seven months on request handling alone.
Vendor contracts. Eleven services at roughly $660 each in review and amendment effort accounts for the $7,300 first-year line. This is the line that most reliably runs over, because it is the only one whose completion depends on somebody else’s legal team replying. Budget the hours; expect the calendar to slip.
Run-rate as a share of year one: 39%
Run-rate per California consumer held: $0.12
That last figure is the one to carry into a board conversation. Twelve cents per consumer per year is a number people can weigh against the alternative, and it reframes the programme from an open-ended legal obligation into a unit cost of holding data — which is what it is.
The three drivers that matter more than your size
Two businesses of identical headcount and revenue can differ by a factor of four on this budget. The spread comes from three places.
How many systems hold personal information. Every additional system multiplies mapping effort, request-fulfilment effort and contract effort at the same time. Consolidating from eleven services to seven does more for this budget than any negotiation will.
Whether you sell or share. Businesses that sell or share personal information inherit the opt-out machinery: a working mechanism, honouring of browser-level signals, and propagation downstream to recipients. Businesses that do neither skip most of that line. This is a product decision with a compliance price tag attached, and it is worth pricing before it is made rather than after.
How much of the work stays manual. A documented manual process is cheap at ten requests a year and ruinous at a thousand. The crossover is a straightforward comparison of licence plus integration against volume multiplied by handling cost, and the same reasoning that governs any control purchase applies — see the ROI of security controls for the general form of the argument.
Compliance cost versus the cost of getting it wrong
Two distinct exposures sit on the other side of this ledger, and conflating them produces bad budgets.
The first is administrative enforcement. The published statutory figures are up to $2,500 per violation and up to $7,500 for an intentional violation or one involving a minor. Because violations are counted per consumer, the arithmetic escalates quickly on paper; enforcement in practice has centred on identified, remediable failures rather than on maximum theoretical totals. How those violations are counted, and why the ceiling is the wrong planning figure, is worked through in CCPA fines and fees: what a violation costs.
The second is the private right of action, which is the larger number and the one that has nothing to do with your privacy notices. It attaches to certain breaches of unencrypted personal information resulting from a failure to maintain reasonable security, at statutory damages of $100 to $750 per consumer per incident. If a breach exposed even 4,000 of our retailer’s 138,000 California records, the lower bound alone is $400,000 — roughly 24 times the annual compliance run-rate — and the upper bound is $3,000,000. Run your own record count through the CCPA/CPRA exposure calculator to see the band for your holdings.
The structural point is that the privacy budget above does not reduce the second exposure. Notices, opt-outs and request workflows are not security controls. Reasonable security is a separate line item, sized against expected loss rather than against statutory text, and the method for sizing it is set out in how much a small business should spend on cybersecurity. A firm that budgeted for one and assumed it had bought the other has covered the cheaper risk.
What this number does not include
Three things sit outside the figures above and should be tracked separately. Legal counsel on your specific facts — applicability, contract language, incident decisions — is unavoidable and unpriced here, because it depends entirely on circumstances a model cannot see. Remediation of whatever the mapping exercise uncovers is genuinely open-ended; inventories routinely surface a retention practice or an unmonitored data flow that costs more to fix than the whole compliance programme. And breach response is a different budget altogether: if an incident occurs, notification cost arrives on its own schedule, and you can size it with the breach notification cost calculator alongside the state-by-state obligations described in US breach notification laws and their cost.
For the wider picture of which regimes attach to which data, and how the penalty ceilings compare across GDPR, HIPAA, CCPA and PCI, see which penalties actually apply to an SMB. Professional bodies such as the IAPP and structured references like the NIST Privacy Framework are useful for turning the inventory work into something repeatable — which is ultimately what makes the run-rate fall rather than rise.
Frequently asked questions
Does the CCPA apply to a business located outside California?
Location is not the test. The law reaches a for-profit entity that does business in California and crosses one of the published thresholds, which means an online retailer in Ohio with a large enough California customer base can be covered while a storefront in Sacramento with modest volume is not. What matters is where your consumers are, not where your servers or your desks are. The California Privacy Protection Agency publishes the current thresholds; confirming whether they apply to your specific facts is a question for counsel, not for a calculator.
How much does it cost to handle one consumer request?
Fully loaded, the range that shows up in planning models is roughly $25 to $60 for a request that can be answered from a small number of well-mapped systems, and several times that when someone has to search unmapped systems by hand. The variable that moves the figure is not the request itself but how well you know where personal information lives. This is why data mapping, which produces nothing a customer ever sees, tends to pay for itself faster than any other line in the budget.
Is a dedicated privacy platform worth it for a small business?
It becomes worth it at the point where request volume multiplied by manual handling cost exceeds the licence plus the integration work — and for many small firms that crossover sits higher than vendors suggest. A firm fielding a handful of requests a month is usually cheaper served by a documented manual process. A firm fielding several a day is not. Model it as a control-ROI question rather than a compliance question: annual cost in, annual cost avoided out.
Does compliance spending reduce the damages exposure from a breach?
Only partly, and the distinction matters for budgeting. The California private right of action attaches to breaches that result from a failure to maintain reasonable security procedures, so it is answered by security spending, not by notices and opt-out links. Privacy-programme cost and security cost are two different budget lines addressing two different failure modes — see how much to spend on cybersecurity for the second one.
Does the cost recur every year, or is it mostly one-off?
Both, in a ratio that surprises people. The first year is dominated by one-off work — mapping, rewriting notices, amending vendor contracts — while the steady state is dominated by handling requests and keeping records. In the worked example below the run-rate is around 39% of the first-year figure. Budgeting the whole amount as one-off, then discovering an annual obligation, is the most common planning error in this area.
Disclaimer. BreachCostLab provides cost and risk estimates for informational purposes only, based on published industry benchmarks (e.g. IBM/Ponemon Cost of a Data Breach, Verizon DBIR) and publicly available statutory figures as of the verification date shown (Jun 25, 2026). These figures are estimates for planning, not a prediction of the cost of any specific incident, and are not legal, financial, insurance, or compliance advice. Actual breach costs vary widely; for regulatory obligations consult qualified counsel. Always verify current figures with the cited sources.