Most MVPs don't meet the CCPA/CPRA threshold at launch, but the trigger isn't revenue — it's data volume, and analytics tools cross it faster than founders expect. If you qualify, plan on $500-$5,000/year for a baseline DIY setup, $10,000-$25,000 for a real program with a built opt-out flow and legal review, or $40,000+/year once a dedicated privacy function is warranted. The bigger number to know: CPRA removed the 30-day cure period, so a violation can draw a penalty with no warning shot.
Founders hear "CCPA" and check their incorporation state, find it's not California, and move on. Wrong test. The law reaches any for-profit business that does business in California and crosses one of three thresholds — and one of those thresholds is consumer count, not company location or revenue.
This note is the threshold test, the tiered cost table, and the one architecture decision — honoring the opt-out signal — that determines whether compliance is a form or a rebuild.
Does your MVP actually need CCPA/CPRA compliance?
Run this test. One yes is enough:
- Annual gross revenue over $26,625,000 (the original $25 million threshold, inflation-adjusted for 2026). Most MVPs are nowhere near this in year one.
- You buy, sell, or share the personal information of 100,000 or more California consumers or households annually. This is the one that surprises founders — a free consumer app with a normal analytics stack (Google Analytics, an ad pixel, a growth tool that shares device IDs) can cross 100,000 California records within months of a single viral post, with zero revenue attached.
- You derive 50% or more of annual revenue from selling or sharing personal information. Ad-supported and data-broker-adjacent models hit this one; most SaaS MVPs don't.
If none apply, you're out of scope — for now. The second threshold is the one to re-check quarterly, not annually, because it moves with growth, not with your fiscal calendar.
What does CCPA/CPRA compliance actually cost?
| Tier | What it covers | Rough cost |
|---|---|---|
| Baseline DIY | Privacy policy, cookie/consent banner, a "Do Not Sell or Share My Info" link, honoring the Global Privacy Control (GPC) browser signal, a manual DSAR intake process | $500-$5,000/year |
| Real program | Everything above plus signed vendor DPAs, a built (not manual) opt-out and deletion flow, a data inventory, and a legal review of your privacy notice | $10,000-$25,000 |
| Dedicated privacy function | Ongoing monitoring, a documented risk assessment for sensitive personal information, a named privacy point of contact, ongoing legal counsel | $40,000+/year |
Costs as of September 2026, for a consumer-facing MVP that has crossed the consumer-count threshold. Add legal review time if you handle sensitive personal information — precise geolocation, biometric data, or data about a consumer's health, which carries its own opt-out-of-use requirement under CPRA.
Why does the 30-day cure period matter more than the fine amount?
The per-violation fines themselves — $2,500 for an unintentional violation, $7,500 for an intentional one or one involving a consumer under 16 — read small next to a seed round. What changed the math is that CPRA removed the 30-day window businesses used to get to fix a violation before a penalty attached. There's no warning shot anymore. A misconfigured opt-out link that's been live for a month is not a bug you quietly patch; it's a violation that already accrued, multiplied by every consumer it touched.
Run the arithmetic once: a single broken opt-out mechanism affecting 100,000 California consumers is a $250 million statutory ceiling before any negotiated reduction. Nobody pays that number — enforcement settlements land far lower — but it's the number that should decide whether you build the opt-out flow correctly the first time or bolt it on after a complaint.
Consumers also get a direct path around the California Privacy Protection Agency entirely: after a qualifying data breach, they can sue for $100-$750 per person in statutory damages, with no need to prove actual harm. That's the exposure a leaked, unencrypted user table creates even before the CCPA's own regulator gets involved.
What's the one build decision that actually sets the bill?
Honoring the opt-out signal correctly, everywhere it fires. Most of the DIY tier is copy and a form — a privacy policy, a banner, a link. The real engineering is making "Do Not Sell or Share" and the Global Privacy Control signal actually stop the sale or share, which means every third-party pixel, every ad SDK, and every analytics tool that shares device or user data has to check that flag before it fires, not just display a toggle that a marketing dashboard ignores. We build this the same way we scope HIPAA's PHI boundary or GDPR's data-processing register: as an architecture decision made in week one, not a settings page added before launch.
Can a product studio build a CCPA-compliant MVP?
Yes, and it's mostly the same engineering discipline that shows up across every privacy regime we build for: minimal data collection by default, vendor agreements signed before any data flows to them, and opt-out logic that's enforced in code, not just described in a policy page. What a studio won't do is act as your privacy officer or sign your CCPA attestation — that responsibility, like the BAA on a HIPAA build, stays with the business that collects the data.
The founders who overpay treat CCPA as a check-the-box privacy policy. The ones who get it right treat the 100,000-consumer threshold as a number to watch from launch day, and the opt-out signal as a piece of infrastructure, not a link in a footer.
Written 2026-09-09 by Abhiraj Sakargaye.