Key Takeaways
- The CCPA revenue threshold in force is $26,625,000, adjusted from the statutory $25,000,000.
- 11 CCR 7100(a) attaches a training duty to whoever handles a guest privacy inquiry.
- A business at 10,000,000 consumers also owes a documented training policy under 7100(b).
- You have 45 calendar days to respond, extendable once by 45 more with notice.
- Name the handler, write the procedure down, and record who acknowledged it.
A guest asks your front-desk agent what personal data the property holds about them. The agent has no procedure to follow and nobody to pass it to. They take an email address, send a note to the property manager, and mark the conversation closed.
A month later the guest has heard nothing back from anyone. Marking it closed is where the exchange failed, and under the California Consumer Privacy Act it failed from the first minute. That failure belongs to the property itself, and often to a compliance department it does not have.
That duty sits with the person the guest spoke to. Neither a published privacy notice nor general staff awareness discharges it. The regulation asks for a named handler, a written procedure and a record showing that both of them exist before a guest ever asks the question.
Which Hotel Properties the CCPA Covers
Written records are what those duties produce, and covering a property starts with 3 thresholds of a different kind. A business needs to meet only 1 of the 3. Two of them count data volume, which surprises hotel groups that think of themselves as small. Those thresholds are set out in California Civil Code 1798.140(d), and 2 of the 3 count data volume.
Threshold | The test |
|---|---|
Revenue | Annual gross revenues above $26,625,000 |
Volume | Buying, selling or sharing data on 100,000 consumers or households |
Share | Deriving 50% or more of annual revenue from selling or sharing |
The revenue figure in that table differs from the one printed in the statute. That statute still reads $25,000,000, and the California Privacy Protection Agency adjusts the figure under Civil Code 1798.199.95(d). Their adjusted amount has been $26,625,000 since January 1, 2025, and it holds through 2026.
That adjustment runs every odd-numbered year, which is why a stale figure circulates so widely. That cycle puts the next change on January 1, 2027. Quoting the statutory number in a policy document leaves your property a year behind its own threshold analysis, which is a poor place to be audited from.
Why the Test Runs at the Enterprise Level
Being a year behind your own threshold is one risk, and running the test at the enterprise level is the other thing that catches hotel groups out. The business definition attaches to whichever legal entity directs the collection and use of personal information across the group, however many individual properties that entity happens to operate. A building where a guest checks in has no separate standing under that definition.
An independent boutique hotel with $8 million in revenue and fewer than 100,000 guest records falls under all 3 thresholds and owes nothing. A regional group whose combined revenue clears $26,625,000 meets the first test, however few records any single property handles. A franchise operator cannot treat each location as separately out of scope once the group crosses the line.
A management company running properties for ownership groups may itself be that business. The analysis follows whoever controls the processing decisions at the group. Groups that have never run that analysis formally should treat the gap as a live risk.
What 11 CCR 7100 Asks of Property Staff
Controlling the processing decisions brings the staff duty with it, and that is the part most privacy programs miss. That duty is 11 CCR 7100(a), which requires all individuals responsible for handling consumer inquiries about the business's information practices to be informed of the CCPA's requirements. They also have to know how to direct consumers to exercise their rights.
At a hotel, those individuals are whoever the guest reaches first. A front-desk agent on an evening shift, a guest services coordinator, and the privacy contact named in the public notice are all covered by the same sentence. None of them is a privacy specialist and all 3 need the briefing.
The Heavier Duty at 10,000,000 Consumers
Briefing them is the floor, and reaching 10,000,000 consumers brings a second obligation on top. Under 7100(b), a business that knows or reasonably should know it handles the personal information of 10,000,000 or more consumers in a calendar year owes more. It shall establish, document and comply with a training policy.
Document is the demanding word in that second sentence. Such a policy existing in somebody's head satisfies neither half of the duty, and a large hotel group crosses this threshold more easily than its managers expect. A separate section, 11 CCR 7102, adds a metrics duty at the same 10,000,000 figure.
The 45-Day Clock and What Runs Against It
Metrics and training both presume a request has been logged, and the clock on it starts the moment a verifiable consumer request arrives. That arrival starts a period set by California Civil Code 1798.130(a)(2), which gives the business 45 calendar days to respond. One extension of up to 45 further days is available where reasonably necessary, if the guest is notified inside the original window.
That 45-day window sounds generous at the front desk and rarely is. A request can land on a Monday and sit in a shared inbox for 12 days while the responsible manager travels. More than a quarter of that window is gone before anybody reads it. Nothing in the regulation pauses while the inbox fills.
Those 45 days are only defensible if 4 things are captured:
- Capture the date the request arrived, ahead of the date somebody noticed it.
- Capture what the guest asked for, in the regulation's own categories.
- Capture who it was assigned to, by name.
- Capture the date and content of the response that went back.
The first of those 4 is the one that decides an enforcement question. If the agency asks when the clock started, a shared inbox cannot answer. Your property is then left arguing about when a message was first read, which is an argument nobody wins.
What the Penalties Look Like
Arguing about when a message was read is expensive, and the penalties clarify why the record matters. Those fines sit in Civil Code 1798.155(a). They run to $2,663 per violation and $7,988 for an intentional violation or one involving a consumer under 16.
Those figures are inflation-adjusted too, replacing the $2,500 and $7,500 printed in the statute. They have been in force since January 1, 2025. Any property quoting the older pair in its training material understates the exposure by roughly 6%.
Put one current procedure on every front desk.
KC Docs keeps one version in force, captures a read-and-sign against that exact version, and lists who has not acknowledged it yet.
Named Handlers, Written Procedures and the Acknowledgment Record
Understating the exposure is avoidable, and recording the acknowledgment is where a privacy notice stops being enough. A published notice tells guests what their rights are. The regulation asks separately whether your staff were informed of the requirements, which is a different question with a different answer.
Those 2 are different artifacts aimed at different audiences. One of the 2 faces the guest and the other faces an investigator. Only the second answers a question about who at the property knew what, and when.
An investigator asking that question gets nothing from a shared inbox either. An inbox holds messages and nothing more, which is the gap policy management software exists to close. What an investigation asks for is the current version of the procedure, the list of people it applies to, and a dated acknowledgment from each of them.
Where KnowledgeCity Fits at the Front Desk
Dated acknowledgments are the answer, and fitting them at the front desk means one current procedure with a name against it. KC Docs holds policies, SOPs and procedures as versioned documents and routes each draft through a named approver chain, where the author cannot approve their own work. One version is in force for its audience at a time.
Evidence comes from the acknowledgment. That evidence is a read-and-sign, capturing the person's saved signature against the exact version they read, so a signature from February stays attached to February's text when a revision publishes in June. Your overdue list then names the agents who have not signed the current one, which is the list a regional manager works through on a Monday morning.
Turnover is why that matters more in hospitality than in most sectors. Your procedure keeps meeting somebody new, and the same discipline helps frontline staff complete mandatory training between shift changes. Those same properties face the threshold question of which guest data falls outside PCI DSS. It is the same kind of analysis, and a library against a custom build is the next decision once the procedure is written.
Frequently Asked Questions
1. What is the CCPA revenue threshold for a hotel group?
The amount in force is $26,625,000 in annual gross revenues, adjusted from the statutory $25,000,000 under Civil Code 1798.199.95(d) and effective from January 1, 2025 through 2026. The California Privacy Protection Agency revises it every odd-numbered year, so the next change falls due on January 1, 2027.
2. Who at a hotel property does the training duty apply to?
Whoever handles consumer inquiries about the business's information practices. 11 CCR 7100(a) requires those individuals to be informed of the CCPA's requirements and of how to direct consumers to exercise their rights. At a property that usually means front-desk agents, guest services coordinators and the privacy contact named in the public notice.
3. What changes at 10,000,000 consumers?
A documented training policy becomes mandatory. Under 11 CCR 7100(b), a business that knows or reasonably should know it buys, receives, sells or shares the personal information of 10,000,000 or more consumers in a calendar year must establish, document and comply with a training policy. A separate section, 11 CCR 7102, adds a metrics duty at the same threshold.
4. How long does a property have to respond to a guest request?
45 calendar days from receipt of a verifiable consumer request, under Civil Code 1798.130(a)(2). One extension of up to 45 further days is available where reasonably necessary, provided the guest is notified inside the original 45-day window.
5. What are the penalties for missing the deadline?
Administrative fines under Civil Code 1798.155(a) run to $2,663 per violation and $7,988 for an intentional violation or one involving a consumer the business knows is under 16. Both figures are inflation-adjusted and have applied since January 1, 2025, replacing the $2,500 and $7,500 printed in the statute.
References
- California Privacy Protection Agency. Updated Monetary Thresholds in the CCPA.
- California Code of Regulations title 11, section 7100. Training.
- California Code of Regulations title 11, section 7102. Requirements for Businesses Collecting Large Amounts of Personal Information.
- California Code of Regulations title 11, section 7001. CCPA Definitions.
- California Code of Regulations title 11, section 7021. Timelines for Responding to Consumer Requests.
- California Privacy Protection Agency. CCPA Regulations and Enforcement.