Does the CCPA Apply to Businesses Outside of California?
The CCPA applies to businesses with users or customers in California, even if they have no physical presence in California and do business entirely online.
Some businesses assume that if they do not have a storefront or office in California, the California Consumer Privacy Act of 2018 (“CCPA”) does not apply to them. That assumption is not only wrong, it could result in regulatory inquiries and monetary penalties.
The CCPA does not require a physical presence in California. If your business is located outside of California but engages in transactions with Californians for the purpose of financial gain – such as offering goods or services – then the CCPA could apply to you. If your business collects any information from California residents – such as through an online website – then the CCPA likely does apply to your business unless it does not meet one of the three thresholds in the law.
The CCPA applies to any business that meets one or more of the following thresholds:
- Has annual gross revenues of more than $25 million
- Buys or sells, or receives or shares for a commercial purpose, the personal information of 50,000 or more California residents
- Derives 50% or more of annual revenues from selling personal information
The CCPA does not regulate commercial conduct that occurs wholly outside of California. However, it is rare today for every part of commercial activity to occur entirely outside of the most populous state in the country. If you’re a for-profit business that operates an online website and that collects any information about California residents – such as IP addresses of web visitors – you should determine whether you meet any of the CCPA’s thresholds and, if you do, come up with a compliance plan.
Even businesses that do not meet one of the thresholds could still be subject to regulation under the CCPA. If a business shares common branding with a company it controls – or that is controlled by it – and that company is subject to the CCPA, the business too is required to adhere to the CCPA, regardless of its revenue.
In short, a business’s lack of physical presence in California does not remove it from the CCPA’s purview. If your business offers goods or services to Californians and collects any personal information from them, the CCPA will apply to your business if it meets one of the thresholds in the law – or shares branding with a business that does.
Privacy work that stays current — without adding more chaos.
TrueVault helps lean ecommerce teams keep privacy workflows current as vendors, tracking tools, and privacy laws keep changing.
