Compliance · Updated September 8, 2026

CCPA / CPRA and analytics

The California Consumer Privacy Act gives California residents rights over their personal information. The California Privacy Rights Act amended the CCPA; it is not a separate replacement law.

Which businesses are covered?

The CPPA describes coverage for qualifying for-profit businesses doing business in California that meet at least one of these thresholds:

  • Annual gross revenue of $26.625 million or more in the preceding calendar year, effective January 1, 2025.
  • Buying, selling, or sharing personal information of at least 100,000 California residents or households.
  • Deriving at least 50% of annual revenue from selling or sharing California residents’ personal information.

Simply having 100,000 visitors is not the same as meeting the buying, selling, or sharing threshold. Service providers and contractors also have obligations. CPPA FAQs.

Rights to account for

The amended CCPA includes rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive information, and receive equal treatment when exercising rights. Covered businesses must also provide privacy information and respect applicable opt-out preference signals. CPPA explanation of consumer rights.

How Fathom fits into your assessment

Fathom’s analytics is designed to measure website activity without tracking cookies. It uses site-specific signatures, and its dashboard presents website statistics. The data journey describes the request information involved and the separate handling of bot records.

Do not assume that hashing makes every record de-identified for legal purposes. Review the information processed and the applicable contractual restrictions with your privacy team. Our DPA and subprocessor list are available for that review.

Keep personal information out of URLs and custom event names, explain your analytics practices in your privacy notice, and consider other tools on your website when assessing sale, sharing, and visitor choices.

These guides explain privacy requirements and how they relate to Fathom. They are general information, not legal advice. Your obligations depend on your website, its visitors, and how you use analytics. Contact us for information about your setup.