The CCPA's 50,000 California Resident Requirement - Easier to Meet Than It Might Seem

At first blush, it might appear that the CCPA will not apply to many businesses, especially small businesses outside California that are not involved in brokering data. But a deeper dive into the CCPA demonstrates that the 50,000-consumer threshold is rather easy to overcome and could apply to many U.S. and foreign businesses.

First, even if a business is not based in California and does not have a physical location in California, the CCPA still applies if the business annually collects the data of 50,000 or more California residents. Moreover, the CCPA broadly defines personal information to encompass "information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(o)(1). This includes not only the usual personal information categories such as names, addresses, Social Security numbers, and driver's license numbers, but also additional categories such as IP addresses, purchasing or consuming histories, browsing history, and information regarding a consumer's interaction with a website. Cal. Civ. Code § 1798.140(o)(1)A–J.

Consequently, if a business's website collects IP addresses, like most do, amassing the personal information of 50,000 California consumers could happen quickly. In fact, this threshold would be met if the website were visited by an average of just 137 California residents per day over the course of the year. This could also be a concern for bloggers and other individuals realizing profits from social media, whose websites may collect personal information from more than 50,000 Californians every year.

Businesses should also be aware that they could be subject to the CCPA if their parent or subsidiary company annually collects the personal information of 50,000 or more California residents. Under section 1798.140(c)(2), "business" is defined to include any entity that controls or is controlled by a business and that shares "common branding," meaning a shared name, service mark, or trademark.

In this digital age in which sales are conducted online and internet advertising is ubiquitous, the CCPA has the potential to affect many more businesses than it would seem at first glance. In order to avoid potential fines and penalties, businesses should carefully assess if the CCPA applies and, if so, ensure that they are in compliance.