The California Consumer Privacy Act (CCPA) applies to the personal information of California residents, regardless of where the processing occurs.

Text of Relevant Provisions

CCPA Section 1798.140(i):

"'Consumer' means a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier."

CCR Title 18, Section 17014(a):

"The term 'resident,' as defined in the law, includes (1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose. All other individuals are nonresidents."

Analysis of Provisions

The CCPA defines its scope of applicability based on the concept of "consumer," which is tied to California residency. This approach extends the law's protections to California residents regardless of their physical location or where the data processing occurs.The definition of residency in CCR Title 18, Section 17014 provides two key criteria:

1. Physical presence in California for non-temporary purposes
2. Domicile in California with temporary absences

This broad definition captures both individuals physically present in California and those who maintain California as their primary residence even when temporarily outside the state. The regulation further elaborates on the meaning of "temporary or transitory purpose," providing examples and guidelines for determining residency status.

Implications

This residency-based approach has significant implications for businesses:

1. Global applicability: Companies worldwide may need to comply with CCPA if they process data of California residents, even if they have no physical presence in the state.
2. Residency determination: Businesses must develop mechanisms to identify California residents among their data subjects, which may be challenging for online services or companies without direct customer relationships.
3. Temporary visitors: Short-term visitors to California (e.g., tourists, business travelers) are generally not covered by CCPA, reducing compliance burdens for businesses catering to temporary visitors.
4. Former residents: The law may continue to apply to data collected while an individual was a California resident, even after they move out of state, potentially requiring ongoing compliance measures.
5. Dual residency: Individuals with homes in multiple states may be covered by CCPA if they meet the California residency criteria, potentially creating overlapping compliance obligations with other state privacy laws.

This residency-based approach aligns with California's interest in protecting its residents' privacy rights, regardless of where data processing occurs. It also reflects the global nature of modern data flows and the challenges of enforcing privacy protections in a digital economy that transcends geographical boundaries.