What Is Personal Information Under the CCPA?

Whether something counts as "personal information" under California law determines almost everything else about CCPA/CPRA compliance, including whether the law applies to your business at all. The definition is broader than most people expect, and it's changed since the CCPA first passed. Here's what currently counts, what doesn't, and where the lines get blurry.

How the CCPA/CPRA Defines Personal Information

The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) define personal information as information that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

That "reasonably capable" language is doing a lot of work, as it means the definition covers data that makes identification possible, not just data that identifies someone outright. There's no format or medium limitation, so images and audio recordings can qualify if they fall under the definition, just as text-based data can.

Personal Information Under CCPA/CPRA

Direct identifiers

Real name, alias, postal address, email address, Social Security number, driver's license or passport number, signature.

Indirect identifiers

Cookies, IP addresses, device or account identifiers, beacons, pixel tags.

Biometric data

Face, retina, fingerprint, voice recordings, and similar data.

Geolocation data

When it's precise enough to identify a person within a defined radius.

Internet or network activity

Browsing history, search history, interaction data with a website or app.

Sensitive personal information

Social Security number, racial or ethnic origin, immigration status, genetic data, precise geolocation, and similar categories that carry additional protections.

What Doesn't Count as Personal Information

De-identified and aggregate data are exempt, but the exemption only holds if the data genuinely can't be re-identified. This is a narrower carve-out than it sounds. Data that seems anonymous on its own, but that a business can reasonably link back to a device, browser, or household (including through inference) doesn't qualify for the exemption.

This is the mechanism behind a common compliance mistake, that of treating "anonymized analytics data" as automatically exempt. If that data is later used to draw inferences for the purpose of creating an advertising or behavioral profile, it can become personal information at that point, even if it wasn't when first collected.

Household Information Is a Separate Category

The CCPA/CPRA also covers household information, which is defined in the implementing regulations as a person or group of people who reside at the same address, share a common device or service, and are identified by the business as sharing a group account or unique identifier. It's a narrower and more specifically defined category than the general personal information definition above, and it's been debated since the law passed for its ambiguity in practice.

Who Has to Comply?

Three separate paths trigger CCPA/CPRA coverage, and a business only needs to cross one of them:

• Gross annual revenue above USD 25 million (the current CPI-adjusted 2025 figure is USD 26,625,000, to be updated again in 2027)
• Handling the personal information of more than 100,000 California consumers or households in a given year, whether bought, sold, received, or shared
• Generating 50 percent or more of annual revenue from selling or sharing personal information

Location doesn't factor in. A business headquartered anywhere in the world is covered the moment it crosses one of these lines and touches a California resident's data.

Global Privacy Control (GPC) and Personal Information

Because cookies and IP addresses qualify as personal information under the CCPA/CPRA, visitors need a way to exercise their opt-out rights over that data. The CPRA doesn't limit that to a manual click. It requires businesses to treat a Global Privacy Control (GPC) signal, sent automatically by a visitor's browser, as a valid request to opt out of the sale or sharing of their personal information.

In practice, this means a business's systems need to recognize the signal and stop selling or sharing that visitor's personal information without waiting for them to find and click a link. The CPPA has named GPC compliance an active enforcement priority.

Enforcement Is Active

The CPRA took effect January 1, 2023. Its implementing regulations were finalized in stages, and a legal challenge briefly delayed enforcement, until California's Third District Court of Appeal ruled on February 9, 2024 that the California Privacy Protection Agency (CPPA), known publicly as CalPrivacy, could enforce them immediately, effective back to July 1, 2023. The CPPA now shares enforcement authority with the California Attorney General, though a business can't be penalized by both for the same violation.

Cookies, IP Addresses, and CIPA: A Related but Separate Risk

The same broad "indirect identifier" definition that makes cookies and IP addresses personal information under the CCPA/CPRA is also, separately, the basis for a wave of private lawsuits under California's decades-old wiretapping law, the California Invasion of Privacy Act (CIPA). While it's a separate statute from the CCPA/CPRA, it's worth mentioning due to the litigation, and because even full CCPA compliance does not protect against CIPA claims.

Plaintiffs argue that cookies and tracking pixels capturing this kind of data before a visitor consents can qualify as an unlawful pen register or wiretap. The courts are currently split on this theory. CIPA carries no revenue or volume threshold, so it applies even to businesses that fall well under every CCPA/CPRA compliance threshold above.

Any individual can file a claim, and no proof of harm is currently required. There is legislation to address some of the issues, but even if passed it will be some time before it comes into effect, and it doesn't touch two of the major sources of litigation.

How Cookiebot CMP Helps with Privacy Compliance for Personal Information

Cookiebot CMP scans your site to detect every cookie, tracker, and third party collecting this kind of data, categorizes what it finds, and keeps your cookie declaration current. It can also block non-essential cookies from firing until a visitor has made a consent choice, and configure the "Do Not Sell or Share My Personal Information" link automatically for visitors it detects are in California. Because it recognizes GPC signals directly, visitors never have to hunt down a link to exercise a right that systems should already be honoring.