CCPA for Non-CA Businesses
The California Consumer Privacy Act only applies to people or organizations doing business in the State of California. So when does the law apply to a Non-CA business?
First, the law only protects California residents. Consumer is defined as a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as provided for on September 1, 2017. If an individual is not a California resident, then the new privacy law does not apply.
Second, the law does not apply to the collection or sale of personal information if every aspect takes place wholly outside of California. The law explicitly provides that the California Consumer Privacy Act does not apply if “the business collected that information while the consumer was outside of California, no part of the sale of personal information occurred in California, and no personal information collected while the consumer was in California is sold.” Data also cannot be stored on a device so that personal information can be transferred once the person is outside California.
The above language makes clear that the law still applies to a transaction where the business is located in California but the California resident is temporarily outside of California.
Third, when should an organization be considered as doing business in California? The CA Consumer Privacy Act does not define the term. However, California Revenue and Taxation Code section 23101 does define what it means to be doing business in California. If this definition is applied to the CA Consumer Privacy Act, the law would apply if (1) the taxpayer actively engages in any transaction for the purpose of financial or pecuniary gain or profit in California; (2) the taxpayer is organized or commercially domiciled in CA; (3) sales in California exceed the lesser of $500,000 or 25% of the taxpayer’s total sales; (4) real and tangible property in California exceeding the lesser of $50,000 or 25 percent of the taxpayer’s total real and tangible personal property; or the amount paid in California by the taxpayer for compensation exceeds the lesser of $50,000 or 25 percent of the total compensation paid by the taxpayer.
Learn more about California’s new law:
Overview of the California Consumer Privacy Act
Right to Opt Out
Right to Access
Right to Delete
Opt In Consent for Kids
Effective Date for Compliance
Application to non-CA Businesses
Do Not Sell My Personal Information Link
Services Providers
Financial Incentives for Information Sharing
Deidentified and Aggregate Consumer Information
Government Fines and Consumer Damages
Text of AB-375
Clarip CA Consumer Privacy Act Services:
California Consumer Privacy Act Webinar
California Privacy Law Consulting Services
California Privacy Software
Blog Posts on the Privacy Law:
Will California’s Privacy Law Extend to the Rest of the Country?
Privacy Policy Changes Required by California Consumer Privacy Act
Big Day for California Privacy Law
California to Pass New Privacy Law
California Consumer Privacy Act Expected on November Ballot