Custom Software in California: Law, Tax, Cost

Custom software in California has to pass three state rules that shape the build long before anyone argues about frameworks: privacy, AB 5 and sales tax. Each one changes a feature, a contract clause or an invoice line, and two of them change again within months. Below we take them one by one, then cover the Pacific-time question, what to ask a vendor and what a project costs.

A disclosure first. We are a remote team in Ahmedabad with no office in the state; our page on California custom software development explains how we cover Pacific mornings. Everything else here applies whoever you hire. None of it is legal or tax advice, so treat each point as a question for your own counsel.

California privacy law, written as product requirements

The Consumer Privacy Act (CCPA), as amended by the Privacy Rights Act, covers for-profit businesses that do business in California and meet any one of three tests. The Attorney General’s FAQ gives them as gross annual revenue over $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling it. The revenue line moves with inflation every odd-numbered year, and the state privacy agency’s current threshold has been $26,625,000 since January 1, 2025. A young company under all three lines is outside the law for now. Plenty cross one within a few years, and bolting a deletion path onto a finished product costs far more than drawing it into the first schema.

Each right as a ticket

Turned into work items, the rights look like this:

The same FAQ says a user-enabled global privacy control must be honoured as a valid request to stop selling or sharing. In practice the page reads the signal on load and applies it before any marketing script fires. That belongs in the front-end ticket, with a test, rather than in the privacy policy alone.

Build it into the data model

The cheapest moment for all of this is the first data model. Know which tables hold personal data, tag the sensitive columns, and keep one function that finds every record belonging to a person. Teams that skip it answer their first deletion request with a week of manual searching.

Risk assessments, audits and automated decisions

The state’s privacy agency (the CPPA, which now calls itself CalPrivacy) has also adopted rules on three things that reach into software. Its rulemaking page records that the Office of Administrative Law approved them on September 22, 2025 and that they took effect on January 1, 2026. Compliance then arrives in stages under the approved text:

• Risk assessments apply to qualifying processing from January 1, 2026. Processing that was already running must be assessed by December 31, 2027, and the first submission to the agency, signed off by an executive under penalty of perjury, is due April 1, 2028.
• Automated decision-making technology (ADMT) used for a significant decision must comply from January 1, 2027, which as we write is less than three months away.
• Cybersecurity audits run on revenue: the first audit report is due April 1, 2028 for businesses over $100 million, April 1, 2029 for $50 to $100 million, and April 1, 2030 below $50 million, each with a certification to the agency.

What a buyer does with this is mostly a matter of the brief. If the software will approve or deny someone credit, a job, housing, a school place or healthcare, the rules count that as a significant decision; say so at kickoff, because how each decision is explained, logged and appealed becomes part of the scope. If the product handles sensitive data at volume, ask the vendor which logs and records the build will keep so an assessment has evidence to point at.

Contractor or vendor: AB 5 and custom software in California

Many founders here hire their first developer as a freelancer, and that is where AB 5 bites. The test it wrote into law now sits in Labor Code section 2775. A worker is an employee unless the hiring entity shows all three of the following, as the state’s Labor and Workforce Development Agency sets out:

1. The worker is “free from the control and direction of the hiring entity.”
2. The work is “outside the usual course of the hiring entity’s business.”
3. The worker is “customarily engaged in an independently established trade, occupation, or business of the same nature.”

The burden is yours, not the worker’s. Prong B is hard for a software company paying someone to build its own product, since writing that code is the usual course of its business. Section 2776 offers a way out for a genuine business-to-business contract: when the provider is a sole proprietor or a company and the hiring business can show all twelve of its conditions, the older Borello test decides the question instead of the ABC test. If a single condition fails, you are back under ABC.

Hiring a vendor instead of a freelancer

Contracting with a firm that employs its own engineers is a different arrangement. The vendor directs, pays and insures its people, and you buy a result. The risk returns if you run that vendor’s engineers as staff, setting their hours and assigning them task by task. Write the contract around milestones and acceptance, and steer at the level of priorities. Our older guide to choosing a web development partner has a wider checklist. Talk to a California employment lawyer before signing anything that looks like a long-term individual contractor.

Sales tax on custom software in California

Revenue and Taxation Code section 6010.9 takes the design, development, writing and transfer of a custom computer program out of the definition of a taxable sale. Custom means prepared to the special order of the customer. A “canned” program held for general or repeated sale does not qualify, even if it started life as somebody’s custom job. When a vendor adapts prewritten software for you, the statute counts the work as custom only to the extent of the modification, and its definition covers modifications billed as separately stated charges.

What SB 122 changes from January 2027

That exclusion survives a large change. Senate Bill 122, signed on June 29, 2026, adds “digital products” to the sales and use tax from January 1, 2027. The California Department of Tax and Fee Administration’s special notice defines a digital product as prewritten software on storage media, downloaded or accessed remotely, and names SaaS providers among those affected. Custom computer software is listed as exempt, and cloud platforms where customers run their own code sit outside the definition.

For a California buyer that has two practical effects:

• The tools around your build. Subscriptions and licences your product depends on may be taxed from 2027. Keep custom development, any licence and any modification work on separate invoice lines.
• The product you are building. If it is a subscription product sold to Californians, you become a seller of a digital product. Generally the sale is placed at the customer’s address, so tax calculation and registration with the department (a seller’s permit, or a use tax registration for an out-of-state seller) belong in the billing work rather than a fix after launch.

The implementing rules were still drafts when we wrote this. At an interested parties meeting on September 10, 2026, the department put forward emergency regulations that move the custom software text into a new Regulation 1502.2, keep the separately-stated rule, and add a Regulation 1600 for digital products. Check the adopted text with a tax adviser before the first invoice of 2027.

Pacific hours and a team in Ahmedabad

No market we serve sits further from Ahmedabad on the clock. India keeps one offset all year; California changes its clocks twice, so the window shifts with it.

Our California engagements hold two live hours, 08:00 to 10:00 Pacific, every working day, for stand-ups, demos and decisions. Everything else moves by written handover. Ask something in your afternoon and the answer is waiting the next morning, because we pick it up while you sleep. Teams that decide quickly and read well get on fine with this. Teams that want an engineer on a call all afternoon will be happier with a firm in their own time zone, and we tell them so. Whoever you choose, put the live hours in the contract, plus the reply time for messages outside them.

Where the state’s sectors change the build

Which rule reaches your software first depends on what the business does. These are the sectors we hear from most in California:

The health row surprises founders most. Civil Code section 56.06(b) deems a business that offers consumers software or hardware, including a mobile app, designed to maintain medical information so a person can manage it, or for the diagnosis, treatment or management of a condition, to be a provider of health care under that Act. Later subsections add mental health and reproductive or sexual health digital services. A symptom tracker or a fertility app can therefore carry medical privacy duties without being a clinic, so tell the vendor on day one if your app will store health data.

The agriculture row is the other one to settle early. Offline sync is an architecture decision; adding it after launch usually means rewriting the data layer.

How to choose a partner for custom software in California

Vendor pages for this state mostly list services and stacks. These questions separate firms better:

• Who writes the code? Ask for the named engineers, interview them, and confirm nothing is subcontracted.
• Whose name is on the accounts? Repositories, cloud accounts and IP should be yours from the first commit.
• How will privacy requests be handled? Ask to see a deletion flow from a past project, or have them explain how theirs reaches backups.
• How will the invoice read? Separate lines for any licence, modification work and installation, which matters more once SB 122 applies.
• What are the live hours? Get the window and the out-of-hours reply time in writing.
• What does the contract say about direction? Deliverables and acceptance criteria, not hours of supervision.

What custom software in California should cost

We keep no separate California rate card, because the state’s rules move the scope more than the rate. The figures on our California page apply. A fixed-scope build starts from $6,500, with the exclusions listed. Dedicated engineers start from $3,200 per engineer per month, and you interview each one before they start. A monthly retainer covers a platform already in production. For custom software in California, compliance is what pushes a quote up: a deletion pipeline, consent handling, audit logs, decision records for ADMT and, for health data, tighter access controls. Ask for each as its own line so you can see what it costs. Our comparison of fixed price, hourly and dedicated-team pricing puts the three models side by side.

From any vendor, expect a written scope, an architecture your own engineers can challenge, and the name of the person who will lead the build, all before you sign. If a firm in your own state would serve you better, a good vendor will say so.