CCPA exemptions fall into two groups. Some organisations are outside the law altogether: nonprofits, government agencies, and for-profit businesses below all three thresholds (annual revenue above $26,625,000, buying, selling or sharing data of 100,000 or more consumers or households, or earning at least 50% of revenue from selling or sharing it). Other exemptions cover data rather than organisations: information governed by the Gramm-Leach-Bliley Act (GLBA), HIPAA or California's medical privacy law, the Fair Credit Reporting Act (FCRA) and the Driver's Privacy Protection Act (DPPA), plus publicly available and de-identified information. A bank or a hospital is exempt for that data only, and still covered for the rest.
The baseline requirements for businesses
The California Consumer Privacy Act imposes strict rules on how businesses handle the personal data of state residents. Many organisations assume these rules apply uniformly to all data they collect.
That assumption often leads to wasted resources and overcomplicated privacy programmes. The law includes specific exemptions based on the type of organisation and the data categories it processes, and identifying them lets you focus on the data that the law actually covers.
Before analysing exemptions, determine whether your company meets the baseline thresholds. The law targets for-profit entities doing business in California that meet at least one of three tests.
A business is covered if its annual gross revenue exceeds $26,625,000, the figure the California Privacy Protection Agency set from 1 January 2025 (previously $25 million). It is also covered if it buys, sells, or shares the personal information of 100,000 or more California residents or households, or derives 50% or more of its annual revenue from selling or sharing personal information. If you meet none of these three conditions, the statute does not apply to you.
Nonprofit organisations and government agencies are generally outside these rules, according to the Attorney General's CCPA guidance. One caveat: an entity that controls or is controlled by a covered business and shares its branding can itself be treated as a business under Civil Code section 1798.140(d)(2).
Is your business or data outside the CCPA?
Data-level exemptions for financial and health data
California exempts the data, not the institution. This is the main difference from Virginia, Texas and most other state laws, which exempt a financial institution subject to the GLBA as a whole.
Healthcare providers and financial institutions rely on these carve-outs to avoid duplicating obligations they already have. A bank handling mortgage applications must follow federal financial privacy rules, and the CCPA steps back for that information. You do not need to apply consumer privacy requests to information governed by these laws.
Medical information governed by California's Confidentiality of Medical Information Act (CMIA) and protected health information collected by a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA) are exempt. The exemption follows the data: a hospital's patient records are out of scope, but the analytics and advertising data its public website collects are not.
However, an exemption for one data type does not grant your entire business immunity.
The GLBA exemption covers data, with one exception
Under Civil Code section 1798.145(e), the CCPA does not apply to personal information collected, processed, sold, or disclosed subject to the federal GLBA, the California Financial Information Privacy Act (CFIPA) or the federal Farm Credit Act. For financial institutions, that covers account and loan data gathered under those acts.
The same subsection ends with an exception: it "shall not apply to Section 1798.150". Section 1798.150 is the CCPA's private right of action for data breaches, so a breach of GLBA-covered data caused by unreasonable security can still lead to a consumer lawsuit under the CCPA. The FCRA and DPPA carve-outs carry the same exception.
Everything outside the GLBA-covered data stays in scope. The marketing cookies on a bank's homepage, the analytics on its blog, and the data of visitors who never became customers are all subject to the CCPA if the bank meets a threshold.
The partial exemption trap
Many organisations misunderstand how these exclusions apply in practice. They assume that being a regulated entity, such as a hospital or a bank, means they can ignore the CCPA entirely.
The exemptions apply to the specific data, not the whole corporate entity. A hospital is exempt regarding its patient health records, but it remains fully liable for the data it collects through its public-facing marketing website. If that hospital tracks website visitors to optimise digital ad spending, those visitors have full rights under state law.
Health data outside HIPAA shows the risk. In July 2025, the Attorney General announced a $1.55 million settlement with Healthline Media, a health information publisher that is not a HIPAA covered entity. Healthline shared data with advertisers that could link a reader to article titles suggesting a medical diagnosis, and failed to honour opt-outs of targeted advertising.
You must maintain separate data governance tracks for different types of information. Your privacy policy must clearly separate your practices for general consumer data from federally regulated information.
Other data-level exemptions
Beyond healthcare and finance, the law carves out exceptions for several other specific categories of information.
| Exemption type | Governing law | What it covers |
|---|---|---|
| Credit reporting | FCRA | Consumer credit history and background check reports |
| Vehicle records | DPPA | Motor vehicle ownership and driver licence records |
| Public information | State and federal records | Lawfully obtained government records |
| De-identified data | None | Data that cannot reasonably be linked to a consumer |
The Fair Credit Reporting Act regulates consumer credit information. Credit bureaus and businesses supplying data to them do not have to provide state-level access or deletion rights for that specific credit data. The Driver's Privacy Protection Act provides a similar carve-out for vehicle records.
Publicly available information forms another major exemption category. The statute defines it as information lawfully made available from federal, state, or local government records. It also includes information a business has a reasonable basis to believe the consumer lawfully made available to the general public.
De-identified or aggregated consumer information sits outside the legal definition of personal data entirely. If you strip data of identifiers so it cannot reasonably be linked back to a specific consumer, the statutory requirements no longer apply.
Unlike the GDPR, which relies on a broader concept of anonymisation, California sets three conditions for de-identified data: you take reasonable measures so it cannot be associated with a consumer, publicly commit not to re-identify it, and contractually bind anyone who receives it to the same rules.
The expiry of the HR and B2B exemptions
California previously offered temporary relief for employee data and business-to-business communications. These exceptions expired on 1 January 2023.
Human resources data and B2B contacts now carry the full weight of consumer privacy rights. Your employees, job applicants, and independent contractors can submit access and deletion requests just like any retail customer. You must provide them with notices at collection.
This expiry expanded the burden for purely B2B companies. A software vendor selling exclusively to other corporations might have ignored the law in 2021. Today, the contact details of their corporate clients qualify as protected personal information.
You must map your internal HR databases and vendor management systems so they can handle consumer requests. The processes you built for retail consumers must now scale to employee data.
How exemptions affect your cookie set-up
As of October 2026, the exemptions have not changed the website side: the cookies and pixels on public pages are almost never covered by a carve-out. The CCPA regulations in force since 1 January 2026 also treat personal information of consumers you know are under 16 as sensitive, which matters for any site with a young audience.
A financial institution might be exempt for data submitted through its secure customer portal but fully covered when it uses marketing cookies on its public homepage. Keep regulated marketing activity separate from exempt operational data, so a tracking script added for marketing does not end up on portal pages.
Running a cookie scanner helps map exactly where personal information flows before you rely on an exemption. You can identify third-party trackers and decide which pages they may run on.
Proper categorisation stops you over-applying the law and breaking necessary site functionality, and it shows where the CCPA's opt-out duties apply to your marketing pages. The overview of global privacy laws covers how other states draw the same lines.
Short answers on CCPA exemptions
Do nonprofit organisations have to comply with the CCPA?
Generally not. The law targets for-profit businesses that meet a revenue or data processing threshold. An entity that controls or is controlled by a covered business and shares its branding can still be treated as a business.
Are government agencies exempt from the CCPA?
Yes. State and local government agencies do not fall under the definition of a business and are excluded from these requirements.
Is employee data still exempt from the CCPA?
No. The temporary exemption for human resources data expired on 1 January 2023. Employees, job applicants and contractors now have the same privacy rights as other consumers.
Does HIPAA compliance mean my entire business is exempt?
No, it gives a partial exemption. Protected health information governed by HIPAA is excluded, but marketing data collected on your public website is still covered by the CCPA.
Is a bank covered by the CCPA if it is subject to the GLBA?
For part of its data. California exempts personal information collected under the GLBA, not the bank itself, so website, marketing and non-customer data stay covered. A breach of GLBA data can still ground a CCPA data-breach lawsuit.
What counts as publicly available information?
Information lawfully made available from government records falls into this category. It also includes information a business reasonably believes the consumer lawfully made available to the general public without restricting it to a specific audience.
Find out which of your pages the CCPA reaches
If part of your data is exempt, you still need to know what your public pages load. Kukie.io scans your site, categorises the cookies it finds, and can show a "Do Not Sell or Share" choice and honour GPC on the pages and regions you set.
