If they have $25m in revenue, receive more than 50k signups a year, or make more than 50% of their revenue selling data on California residents they are subject to CCPA.

CCPA actually has way more teeth than GDPR, because California's Unfair Competition Law allows residents to enforce laws that do not otherwise provide a private right of actions. (though this still needs to be proved out in the courts)

In theory. Has any company seen the pointy end of GDPR yet?