The California Consumer Privacy Act (CCPA) does not explicitly use the factor of "offering goods and services to data subjects in California" as a primary criterion for determining its applicability. Instead, the CCPA focuses on businesses that collect personal information from California residents and meet certain thresholds.

Text of Relevant Provisions

CCPA Section 1798.140(d)(1):

"'Business' means: (1) A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:"

CCPA Section 1798.140(s):

"'Intentionally interacts' means when the consumer intends to interact with a person, or disclose personal information to a person, via one or more deliberate interactions, including visiting the person's website or purchasing a good or service from the person. Hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer's intent to interact with a person."

Analysis of Provisions

The CCPA does not specifically use the concept of "offering goods and services" to determine its applicability. Instead, it focuses on businesses that "collect consumers' personal information" and "do business in the State of California". The law applies to such businesses if they meet certain thresholds related to revenue, data processing volume, or revenue derived from selling consumers' personal information.

However, the definition of "intentionally interacts" in Section 1798.140(s) includes "visiting the person's website or purchasing a good or service from the person". This suggests that businesses offering goods or services to California residents may fall under the CCPA's scope if they collect personal information through these interactions and meet the other criteria for a "business" under the law.

The CCPA's approach differs from laws like the EU's GDPR, which explicitly includes offering goods or services to data subjects as a factor for territorial scope. The CCPA instead focuses on the business's presence in California and its collection of California residents' personal information.

Implications

For businesses, this means:

1. Companies outside of California may still be subject to the CCPA if they collect personal information from California residents and meet the law's thresholds, regardless of whether they specifically target California consumers.
2. Simply offering goods or services to California residents is not enough to trigger CCPA obligations. The business must also collect personal information and meet the law's thresholds.
3. Businesses should assess whether they "do business in the State of California" and collect personal information from California residents, rather than focusing solely on whether they offer goods or services to Californians.
4. Companies that intentionally interact with California consumers, including through website visits or purchases, should be aware that these interactions may involve collecting personal information subject to the CCPA.
5. The broad definition of "business" in the CCPA means that companies should carefully evaluate their data collection practices and California connections, even if they don't have a physical presence in the state.