GDPR has no revenue threshold and no exemption for small businesses. If your site sets a tracking or analytics cookie on a visitor physically located in the EU, that interaction falls under GDPR's "monitoring" provision — regardless of your company's size, industry, or where you're incorporated. Serious violations carry fines up to €20 million or 4% of global annual revenue.

CCPA/CPRA itself only applies once a business crosses a size threshold (roughly $26.6M in revenue, or personal data on 100,000+ California residents/devices a year — easier to hit than it sounds once ad-tech data-sharing counts toward it). The bigger current risk is a separate, older law: the California Invasion of Privacy Act. Courts have found that tracking a visitor's activity before they've consented can qualify as illegal wiretapping under CIPA — a law with no size threshold, that lets any individual visitor sue directly. Nearly 4,000 CIPA lawsuits were filed in California through 2026, most involving ordinary tools like Google Analytics, Meta Pixel, and chat widgets.