Skip to Content

The CCPA's 50,000 California Resident Requirement - Easier to Meet Than It Might Seem
August 06, 2019
When the California Consumer Privacy Act (CCPA) takes effect in January 2020, it will grant California residents new rights regarding their personal information and will impose new and significant obligations on businesses that collect this information. The CCPA applies to all types of for-profit business entities — from sole proprietorships to corporations — that meet one of three criteria: (1) the business has gross revenues in excess of $25 million; (2) the business annually buys, receives, sells, or shares the personal information of 50,000 or more California residents; or (3) the business derives 50% or more of its annual revenues from selling California residents' personal information. Cal. Civ. Code § 1798.140(c).

At first blush, it might appear that the CCPA will not apply to many businesses, especially small businesses outside California that are not involved in brokering data. But a deeper dive into the CCPA demonstrates that the 50,000-consumer threshold is rather easy to overcome and could apply to many U.S. and foreign businesses.

First, even if a business is not based in California and does not have a physical location in California, the CCPA still applies if the business annually collects the data of 50,000 or more California residents. Moreover, the CCPA broadly defines personal information to encompass "information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(o)(1). This includes not only the usual personal information categories such as names, addresses, Social Security numbers, and driver's license numbers, but also additional categories such as IP addresses, purchasing or consuming histories, browsing history, and information regarding a consumer's interaction with a website. Cal. Civ. Code § 1798.140(o)(1)A–J.

Consequently, if a business's website collects IP addresses, like most do, amassing the personal information of 50,000 California consumers could happen quickly. In fact, this threshold would be met if the website were visited by an average of just 137 California residents per day over the course of the year. This could also be a concern for bloggers and other individuals realizing profits from social media, whose websites may collect personal information from more than 50,000 Californians every year.

Businesses should also be aware that they could be subject to the CCPA if their parent or subsidiary company annually collects the personal information of 50,000 or more California residents. Under section 1798.140(c)(2), "business" is defined to include any entity that controls or is controlled by a business and that shares "common branding," meaning a shared name, service mark, or trademark.

In this digital age in which sales are conducted online and internet advertising is ubiquitous, the CCPA has the potential to affect many more businesses than it would seem at first glance. In order to avoid potential fines and penalties, businesses should carefully assess if the CCPA applies and, if so, ensure that they are in compliance.
Authored By
Image: Gregory A. Gidus
Gregory A. Gidus
Related Practices
Cybersecurity and Privacy
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.

Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.