The CCPA applies to a “business” that collects the personal information of “consumers” that are California residents.
A “Consumer” is deﬁned under the CCPA as a California resident.
- The California Code of Regulations deﬁnes a resident as follows: “(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose. All other individuals are nonresidents.”
A “Business” is deﬁned by the CCPA as a for-proﬁt entity that collects “consumer” data and also meets one of the following criteria:
- Has at least $25 Million in annual gross revenue;
- Annually buys, receives, sells or shares the personal information of 50,000 or more consumers, households, or devices for commercial purposes;
- Derives 50% or more of its annual revenue from selling consumer personal information.
A “Service Provider” is deﬁned by the CCPA as any entity that processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract.
Notably, the CCPA applies to all businesses, as deﬁned above, that collect data from California residents — regardless of the location of the headquarters of the business itself. In other words, it applies to businesses that are physically located outside of California.