🇺🇸
USA - California

Territorial Scope

The CCPA applies to businesses operating in California with key provisions defining territorial scope:

Section 1798.145(a)(7) establishes that the law does not apply when:

  • All aspects of commercial conduct take place wholly outside California
  • Information was collected while consumer was outside California
  • No part of personal information sale occurred in California
  • No personal information collected in California is sold

Material Scope

Business Thresholds

Per Section 1798.140(d), the CCPA applies to businesses that:

  1. Are for-profit entities
  2. Collect consumers' personal information
  3. Determine purposes and means of processing
  4. Do business in California
  5. Meet one or more of these thresholds:
    • Annual gross revenue exceeding $25 million
    • Annually buys/sells/shares personal information of 100,000+ consumers/households
    • Derives 50%+ of annual revenue from selling/sharing consumer personal information

Key Exemptions

Sectoral Exemptions (Section 1798.145)

  1. Healthcare/Medical Information:
  • HIPAA-governed entities (c)(1)(A)
  • Medical information under CMIA (c)(1)(B)
  • Clinical trials and biomedical research (c)(1)(C)
  1. Financial Services:
  • Gramm-Leach-Bliley Act data (e)
  • California Financial Information Privacy Act (e)
  • Federal Farm Credit Act information (e)
  1. Other Regulated Sectors:
  • Driver's Privacy Protection Act data (f)
  • Credit reporting activities (d)(1-2)
  • Vehicle/vessel warranty information (g)(1-2)

Purpose-Based Exemptions (Section 1798.145)

  1. Law Enforcement/Government:
  • Compliance with legal obligations (a)(1)
  • Law enforcement investigations (a)(2)
  • Emergency access for government agencies (a)(4)
  1. Other Purposes:
  • Legal claims (a)(5)
  • Vehicle/vessel repair and warranty purposes (g)(1-2)

Other Notable Exemptions

  1. Personal/Non-Commercial:
  • Personal/domestic use (l)
  • Non-commercial activities protected by California Constitution (l)
  1. Professional Communications:
  • Business-to-business communications (n)(1)
  • Employee-related information (m)(1) (until January 1, 2023)
  1. Privileged Information:
  • Communications protected by evidentiary privileges under California law (b)


🇺🇸

USA - California

🗞️ Exception for Publicly Available Information, including Public Records🔗 Processing in Context of Local Establishment👮🏼 National Security and Law Enforcement Exemption🎯 Exemption for Specific Purposes of Processing📍 Processing by Local Establishment🛂 Applicability to Citizens and Residents' Data💼 Processing by Entity Registered or Incorporated in Jurisdiction🛍️ Offering Goods and Services to Data Subjects in Jurisdiction🏡 Personal and Domestic Use Exemption Sale of Personal Data Criterion💵 Revenue-Based Applicability⚖️ Sectoral Exceptions Regulated by Other Laws🛃 Exception for Data Processing Outside Jurisdiction🧮 Number of Data Subjects🧓🏿 Long-Term Residency Threshold👇🏿 Statutory Requirement Processing Exception💼 Doing Business in Jurisdiction

globe_book Resources (1)

link California Privacy Protection Agency (CPPA)

Groups Consultants: (0)