Do state privacy laws like the CCPA apply to you?

The short answer

For most home service companies, comprehensive state privacy laws such as the CCPA do not apply, because they are written for larger businesses or for businesses whose model depends on personal data. But ‘most’ is not ‘all’, and the tests are easy to misread. A regional HVAC company with a busy website, or a lead-generation side business, can cross a threshold without noticing. This guide walks through the tests so you can check, and it is general information, not legal advice; speak to an attorney about your situation.

California matters most for this trade because so many contractors are there. California had the most plumbing, heating and air-conditioning contractor establishments in the country in 2023, with 11,686, or 10.5% of the national total^[3].

California: the three CCPA tests

The California Attorney General describes the CCPA as applying to for-profit businesses that do business in California and meet any one of the following^[1]. The revenue figure is adjusted periodically, so check the current number with the state.

Two traps catch small companies. First, the 100,000 test counts residents or households^[1], which can include website visitors identified by device data, not just paying customers. Second, under California's rules ‘sharing’ can include passing personal information to advertising platforms for cross-context behavioral advertising. If your website runs advertising pixels and gets heavy traffic from California, ask counsel whether you are counting correctly.

Worked examples

• Example: a fictional two-truck electrical contractor in Sacramento with a few thousand customers and a simple website with no ad pixels. Well below every test. The CCPA almost certainly does not apply; good security habits still do.
• Example: a fictional HVAC group with $40 million in revenue across California locations. Over the revenue test. The CCPA applies, and the company needs a privacy notice, a way to handle consumer requests and vendor contracts that meet the law.
• Example: a fictional roofing company with modest revenue but a high-traffic storm-damage website using ad retargeting across California. Possibly near the 100,000 test, depending on how visitors are counted and whether data is ‘shared’. Needs a proper count and legal advice.
• Example: a fictional lead-generation site that sells homeowner repair leads to contractors and earns most of its revenue that way. Likely meets the 50% test regardless of size.

Virginia and laws built like it

Many states have passed comprehensive privacy laws since California, and many follow a pattern based on how many consumers' data you handle rather than revenue. Virginia's Consumer Data Protection Act applies to businesses that do business in Virginia or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data^[2].

Thresholds, exemptions and definitions differ by state, and some states use different tests altogether. Make a list of every state where you have customers or advertise, and check each law's applicability section, or ask your attorney to do it once a year.

How to count your numbers

1. 01

   Revenue

   Take gross annual revenue from your accounts, for the whole business and any affiliated companies that share branding or data.

2. 02

   Customers and contacts

   Count unique customers, leads and contacts by state in your job management and CRM systems, including old records you still hold.

3. 03

   Website visitors

   Check analytics for unique visitors by state, and list any advertising pixels, tags and data-sharing tools on your site.

4. 04

   Data sales and sharing

   List anywhere you sell, rent or exchange customer data, including lead swaps with other contractors and marketing partners.

5. 05

   Record the result

   Write down the numbers, the date and who checked. Repeat each year or after a merger, acquisition or big marketing change.

If the count comes out close to a threshold, don't round down. Growth in a good storm season, an acquisition or a new marketing campaign can push you over within a year, and setting up a compliant process takes time. Start the work while you are still under the line.

What applies regardless of size

Falling below a privacy law's threshold does not mean anything goes. Other rules still apply to small companies:

• Reasonable data security. The FTC's guide for businesses sets out five principles: take stock, scale down, lock it, pitch it and plan ahead^[4].
• Breach notification laws, which can require you to tell customers and regulators if certain data is exposed.
• Telemarketing and texting rules for marketing calls and messages.
• Call-recording consent laws, which differ by state.
• Consumer protection law against deceptive statements, including what your privacy statement promises.

Myths that cause trouble

• ‘We're too small for any of this.’ Size thresholds apply to comprehensive privacy laws, not to security, breach notification, telemarketing or recording-consent rules.
• ‘We're not in California, so the CCPA can't apply.’ The law is about doing business in California and handling Californians' data, not only where your office is. A company near a state line, or one advertising across it, should check.
• ‘We don't sell data.’ Selling isn't only taking money for a list. Exchanging leads with a partner, or letting an ad platform collect visitor data for its own use, may count under some laws.
• ‘Our privacy policy template covers us.’ A template that describes practices you don't follow is itself a risk under consumer protection law.
• ‘Employee data doesn't count.’ Some state laws cover job applicants and employees too. Technician GPS and in-cab camera data deserve the same care as customer data.

Handle requests well even when no law requires it

Customers sometimes ask you to delete their information or stop contacting them, whatever the law says. Treat these requests as service. Confirm who is asking, remove them from marketing lists straight away, and explain what you must keep, such as invoices and warranty records your accountant or state rules require. Write down the request, the date and what you did. A simple, polite process costs little and prevents complaints, and if your company later grows past a threshold, the habit is already in place.

If a law does apply

1. Map the personal information you collect, where it goes and why.
2. Publish a privacy notice that matches what you actually do.
3. Set up a way to receive and answer consumer requests to know, delete or correct their data, and verify who is asking.
4. If you sell or share personal information, provide the opt-out the law requires. In California that means a clear ‘Do Not Sell or Share My Personal Information’ link^[1].
5. Put compliant terms in contracts with vendors that handle customer data: job software, call tracking, answering services, AI phone tools and marketing agencies.
6. Train the office to recognize a privacy request when it arrives by phone or email.
7. Review every year with counsel.

Questions to ask your attorney

• Which state laws apply to us now, and which would apply if we grow into a new state?
• Do our website pixels or lead sources count as selling or sharing?
• What should our privacy notice say, and how often should we update it?
• How should we handle and document consumer requests?
• What must our vendor contracts include?

Related reading

Whether or not a privacy law applies, start with the security basics in protecting customer data at a small service company, and check what your AI and phone vendors do with call data using questions to ask an AI vendor about data privacy.