The Tennessee Information Protection Act (TIPA) uses the factor of offering goods and services to data subjects in Tennessee as part of determining its applicability, but it is not the sole criterion.

Text of Relevant Provision

TIPA Sec. 47-18-3202 states:

"This part applies to persons that conduct business in this state producing products or services that target residents of this state and that:"

Analysis of Provision

The provision in TIPA Sec. 47-18-3202 establishes a two-part test for the law's applicability:

1. "persons that conduct business in this state"
2. "producing products or services that target residents of this state"

The phrase "producing products or services that target residents of this state" is directly related to the factor of offering goods and services to data subjects in Tennessee. This language suggests that the law applies not just to businesses physically located in Tennessee, but also to those that intentionally direct their products or services towards Tennessee residents.

However, it's important to note that this is not the only requirement for TIPA's applicability. The provision continues with additional criteria:

"and that: (1) Exceed twenty-five million dollars ($25,000,000) in revenue; and (2) (A) Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or (B) During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers."

These additional criteria create a threshold based on revenue and the scale of data processing, which must be met in conjunction with the targeting of Tennessee residents.

Implications

The implications of this provision for businesses are significant:

1. Extraterritorial reach: Companies outside of Tennessee may fall under TIPA's jurisdiction if they specifically target Tennessee residents with their products or services.
2. Intent matters: The use of the word "target" suggests that merely having a website accessible to Tennessee residents may not be sufficient. There likely needs to be some intentional direction of products or services towards Tennessee residents.
3. Scale considerations: Even if a business targets Tennessee residents, it must also meet the revenue and data processing thresholds to fall under TIPA's scope.
4. Compliance assessment: Businesses will need to evaluate not only their physical presence in Tennessee but also their marketing strategies and customer base to determine if they are "targeting" Tennessee residents.
5. Data volume tracking: Companies will need to keep track of the volume of Tennessee consumers' data they process to determine if they meet the numerical thresholds.

This approach balances the protection of Tennessee residents' data with the practical considerations of regulating businesses, focusing on those with significant impact due to their size or data processing activities.