A small business with fewer than 20 employees faced roughly $50,000 in initial CCPA compliance costs, according to a 2019 economic impact assessment that Berkeley Economic Advising and Research prepared for the California Attorney General. That number is nearly seven years old and predates both the CPRA and California's 2025 cybersecurity-audit rules, but it remains the only granular, primary-source estimate of what CCPA compliance costs a business at the smallest end of the size scale, and the newer statewide figures below show the bill has only grown since.
How much does CCPA compliance cost a small business?
The 2019 Standardized Regulatory Impact Assessment, submitted to the California Department of Finance on August 15, 2019 ahead of the CCPA's original regulations, modeled initial compliance costs by company size rather than a single flat number. A business with under 20 employees was projected to spend about $50,000 getting compliant; a midsized firm with 20 to 100 employees was projected to spend about $100,000, roughly double.
Figure 1: Berkeley Economic Advising and Research's 2019 initial-compliance-cost estimate by employee count. Source: California Department of Finance, Standardized Regulatory Impact Assessment (August 2019).
The report did not model a smaller "micro-business" tier below 20 employees, so a solo founder or a five-person shop building a first privacy policy and consumer-request process likely spends less than the $50,000 figure in practice. It also predates the CPRA's 2023 expansion of CCPA and California's newer 2025 rules covered later in this post, so treat it as a floor rather than what compliance costs today. Businesses starting from nothing can generate a CCPA-compliant privacy policy built around the same consumer-rights disclosures the state's own cost model assumes a business has to build from scratch.
Takeaway: the original per-business cost estimate scales roughly linearly with company size at the low end, doubling from the smallest to the next tier up.
Why did California estimate CCPA compliance could cost $55 billion statewide?
The same 2019 assessment put California's total initial compliance cost at up to $55 billion, based on the assumption that roughly 75% of California businesses would be affected by the law in some way. That statewide figure combines the per-business cost tiers above across an estimate of every business the CCPA's original 2018 thresholds could reach, not just the largest companies.
| Metric | 2019 estimate | Source |
|---|---|---|
| Initial cost, under 20 employees | $50,000 | Berkeley Economic Advising and Research |
| Initial cost, 20 to 100 employees | $100,000 | Berkeley Economic Advising and Research |
| Statewide initial cost (all businesses) | up to $55 billion | Berkeley Economic Advising and Research |
| Share of CA businesses affected | 75% | Berkeley Economic Advising and Research |
| 10-year total cost, 2020 to 2030 | $467 million to $16.454 billion | Berkeley Economic Advising and Research |
The same report separately modeled ongoing compliance costs, not just the initial setup bill, at $467 million to $16.454 billion over the 2020 to 2030 period, a wide range that reflects how much the final number depends on how strict subsequent regulations turned out to be. That range proved conservative on the low end: the newer 2025 rules alone, covered next, add billions more than the bottom of that original range.
Takeaway: even in 2019, before any of today's cybersecurity-audit or automated-decision-making rules existed, California's own economists expected CCPA compliance to be a multibillion-dollar statewide undertaking.
What do the new 2025 cybersecurity-audit and ADMT rules add to the bill?
California's cybersecurity-audit, risk-assessment, and automated-decision-making-technology (ADMT) regulations, finalized by the California Privacy Protection Agency (CPPA) in 2025, add a new cost layer on top of baseline CCPA compliance. The CPPA's 2024 Standardized Regulatory Impact Assessment modeled $3.5 billion in direct first-year costs across all covered businesses, moderating to an average of $1.08 billion a year over the following decade as one-time setup work gives way to routine maintenance.
Figure 2: First-year direct cost breakdown by regulation category, in USD billions. Source: California Privacy Protection Agency, Standardized Regulatory Impact Assessment (2024).
Cybersecurity audits account for the largest share of that first-year bill at an estimated $2.1 billion, followed by the ADMT rules at $0.8 billion, general updates to existing CCPA regulations at $0.4 billion, and risk assessments at $0.2 billion. Only a subset of the 52,326 businesses the CPPA estimates are covered by the CCPA overall will owe any of these newer costs; most small businesses will owe none of them at all unless they cross the specific thresholds covered next. For the full breakdown of which businesses count toward that 52,326 figure and how the CCPA's applicability tests work, see how many businesses must comply with the CCPA.
Takeaway: the newer rules cost roughly as much in their first year alone as the entire low end of the 2019 report's 10-year ongoing-cost estimate.
How much does a CCPA cybersecurity audit actually cost?
A CCPA cybersecurity audit can cost an individual business anywhere from $40,000 to $363,000, according to Wilson Sonsini's August 2024 review of the CPPA's draft cost assessment, which estimated the requirement would cost the roughly 25,167 businesses that meet the audit criteria a combined $2.1 billion in its first year. That per-business range is wide because audit cost scales with how much personal information a business processes and how complex its systems are, not a flat fee.
Figure 3: The CCPA cybersecurity-audit trigger test and its estimated per-business cost range. Source: California Civil Code Section 1798.185, as summarized by Wilson Sonsini (August 2024).
Both of the audit's qualifying tests require meaningful scale, either a revenue threshold well above what most true small businesses reach, or a personal-information volume that only businesses handling consumer data at meaningful scale will cross. A five-person local service business is very unlikely to meet either test; a mid-sized data-driven retailer or ad-tech company is far more likely to.
Takeaway: the audit requirement's cost range is wide because it is not a flat mandate. It only applies to businesses that already handle personal information at real scale.
When do small businesses actually have to pay these new costs?
The cybersecurity-audit deadline is staggered by revenue, giving smaller covered businesses years longer to prepare than the largest companies. Businesses with more than $100 million in 2026 revenue must complete their first audit by April 1, 2028; businesses with $50 million to $100 million in 2027 revenue have until April 1, 2029; and businesses under $50 million in 2028 revenue have until April 1, 2030.
Figure 4: Key cost-related milestones from the CCPA's 2018 signing through the last staggered audit deadline. Source: California Legislative Information; California Privacy Protection Agency.
ADMT rules apply on a single date rather than a staggered one: businesses using automated decision-making technology for a "significant decision," covering finances, housing, education, employment, or healthcare, must comply beginning April 1, 2027. Risk assessments for the CCPA's seven categories of high-risk processing carry their own deadline, with initial assessments due by December 31, 2027.
Takeaway: a small business under $50 million in revenue that does not yet meet the audit or ADMT thresholds has real runway, potentially years, before any of these newer cost layers apply, if they ever do.
Did the CPPA lower its cost estimate before finalizing the rules?
Yes. The CPPA's board voted to finalize the cybersecurity-audit, risk-assessment, and ADMT regulations on July 24, 2025, and in doing so revised its 10-year cost estimate for businesses down to $4.8 billion from an earlier $10 billion projection, according to the agency's own account reported by IAPP. The agency's executive director framed the revision as a result of changes made to the final rule text during the rulemaking process, not a change in the underlying economic model.
The same finalized assessment projects $282 billion in economic benefits to California over the same 10-year period, attributed mostly to reduced cybercrime losses stemming from the cybersecurity-audit and risk-assessment requirements. Regulators publish that benefit figure to argue the rules pay for themselves many times over at a statewide level; it says nothing about whether the specific cost a given small business faces will be offset by benefits that business itself can measure.
Takeaway: the finalized 2025 rules cost businesses roughly half of what the CPPA originally projected, but the number still moved in one direction only, down from an even larger initial estimate, not toward zero.
The Bottom Line
The honest answer to "what does CCPA compliance cost a small business" depends heavily on which small business you mean and which year's rules you are pricing. Berkeley Economic Advising and Research's original 2019 estimate, $50,000 for a business under 20 employees and $100,000 for one with 20 to 100 employees, is still the most-cited, most granular per-business figure available, but it predates nearly every rule California has added since, including the cybersecurity-audit and ADMT requirements covered here. Most genuinely small businesses will never owe the newer $40,000-to-$363,000 audit cost, since it only applies once a business crosses real revenue or data-volume thresholds, and businesses under $50 million in revenue have until 2030 before that deadline even arrives. The practical number to budget against is not one figure but a layered one: a base compliance cost in the tens of thousands for the smallest businesses, rising sharply only once a business grows into the thresholds that trigger California's newer, more expensive rules. For the fuller picture of privacy-compliance spending beyond California alone, see our cost of privacy compliance roundup.
Frequently Asked Questions
What is the average cost of CCPA compliance for a small business? About $50,000 in initial compliance costs for a business with fewer than 20 employees, according to Berkeley Economic Advising and Research's 2019 economic impact assessment prepared for the California Attorney General. That figure predates the CPRA and the state's 2025 cybersecurity-audit and automated-decision-making rules, which add further cost for larger covered businesses.
Do small businesses have to pay for CCPA cybersecurity audits? Only if they cross specific thresholds, and most small businesses will not for years. A business needs either $25 million or more in annual gross revenue combined with processing 250,000 or more consumers' personal information, or deriving 50% or more of revenue from selling personal information, and businesses under $50 million in 2028 revenue have until April 1, 2030 to complete their first audit, per the California Privacy Protection Agency's finalized rules.
How much will California's new CCPA rules cost businesses in total? $3.5 billion in direct first-year costs across all covered businesses, moderating to an average of $1.08 billion a year over the following decade, according to the California Privacy Protection Agency's 2024 Standardized Regulatory Impact Assessment. The agency's board later revised its 10-year cost estimate down to $4.8 billion when it finalized the rules in July 2025.
How much does a CCPA cybersecurity audit cost? Between $40,000 and $363,000 per business, according to Wilson Sonsini's August 2024 review of the CPPA's draft cost assessment, which estimated the requirement would cost audited businesses a combined $2.1 billion in its first year across roughly 25,167 businesses that meet the audit criteria.
Where the Numbers Come From
- California Department of Finance / Berkeley Economic Advising and Research, LLC. (2019). "Standardized Regulatory Impact Assessment: California Consumer Privacy Act of 2018 Regulations." Submitted August 15, 2019; source for the $50,000 and $100,000 per-business tiers, the $55 billion statewide estimate, the 75% figure, and the $467 million to $16.454 billion 10-year cost range.
- CNBC. (2019). "California's New Privacy Law Could Cost Companies a Total of $55 Billion to Get in Compliance." Contemporaneous press coverage corroborating the 2019 Standardized Regulatory Impact Assessment's figures.
- California Privacy Protection Agency. (2024). "Standardized Regulatory Impact Assessment." Prepared by Berkeley Economic Advising and Research for the October 4, 2024 board meeting; source for the $3.5 billion first-year cost, the $1.08 billion 10-year average, the per-rule cost breakdown, and the 52,326-business and 25,167-business estimates.
- Wilson Sonsini, The Data Advisor. (2024). "Substantial New CCPA Regulations Inch Closer to Reality." Law firm review of the CPPA's draft cost assessment; source for the $40,000 to $363,000 per-business cybersecurity-audit cost range.
- IAPP. (2025). "CPPA Board Finalizes Long-Awaited ADMT, Cyber Audit, Risk Assessment Rules." Reports the July 24, 2025 board vote, the revised $4.8 billion 10-year cost estimate (down from $10 billion), and the $282 billion projected economic benefit.
- Skadden, Arps, Slate, Meagher & Flom LLP. (2025). "California Finalizes CPPA Regulations for Automated Decision-Making Technology, Risk Assessments and Cybersecurity Audits." Source for the staggered cybersecurity-audit deadlines by revenue tier and the ADMT and risk-assessment compliance dates.
Note: All figures verified as of September 2026. The 2019 Berkeley Economic Advising and Research estimates are the most granular per-business figures publicly available but are nearly seven years old; the CPPA's 2024 to 2025 figures for the newer cybersecurity-audit, ADMT, and risk-assessment rules are refreshed here as later SRIA editions or enforcement data become available.
