Should your application calls for your customers to enter their info on their unique gadgets, then you qualify for SAQ A. This permits all organizations—from significant organizations to startups and modest and medium enterprises, which may not possess the requisite security infrastructure and team—to remain guarded and PCI DSS compliant. https://www.nathanlabsadvisory.com/ccpa.html