Under the CCPA, when is an out-of-state company 'doing business in California', and when does the wholly-outside-California exemption in 1798.145 apply?
answer
- an element with no definition
- facts, not a statutory test
- where the consumer was at collection
- no part of the sale in California
- a reproductive-health exception
basics
~20 sThe Civil Code never defines 'does business in the State of California', so nexus turns on facts such as selling to, marketing to and collecting data from Californians. Separately, 1798.145(a)(1)(G) frees conduct only when every aspect happens wholly outside California.
solid answer
~50 sDoing business in California is an element of the business definition in Civil Code `1798.140(d)(1)`, but the title does not define it, so it is a factual judgement: selling or shipping to Californians, targeting them with marketing, or collecting their personal information through an online service all point to nexus, and the text contains no physical-presence requirement. Because the revenue threshold is not limited to California revenue, nexus often does the real filtering for large out-of-state companies. Separately, `1798.145(a)(1)(G)` says the title does not restrict collecting, selling or sharing personal information when **every aspect** of the conduct is wholly outside California: collected while the consumer was outside California, no part of the sale in California, and nothing collected in California sold. Under `1798.145(a)(2)(A)`, that carve-out falls away for information about seeking contraception, pregnancy or perinatal care, including abortion services.
go deeper
Recall that a CCPA business must do business in California, and that physical presence in the state is not written into the text.
Explain that the title leaves the phrase undefined, and list the facts that point to nexus: selling to, marketing to and collecting from Californians.
Apply 1798.145(a)(1)(G) precisely: collection while the consumer was outside California, no part of the sale in California, nothing collected in California sold, and the reproductive-health exception.
Judge whether recording collection location to use the carve-out is worth building, versus treating all Californians' data as in scope wherever it was collected.
## The nexus element Civil Code `1798.140(d)(1)` requires a CCPA business to be an entity 'that does business in the State of California'. The same phrase appears in `1798.140(d)(4)`, the voluntary-certification route. The title **does not define** it. That is the first thing to say in an interview: the element is real, but where its boundary falls is a question of facts and judgement, not of a statutory test. ## Reading 'does business in California' With no definition, the analysis looks at what the company actually does with California and Californians. Facts a practitioner weighs: - **Selling to Californians**: shipping goods to California addresses, selling subscriptions or services to California residents. - **Targeting**: marketing aimed at California, California-specific offers, pricing or content. - **Collecting online**: a website or app that California residents use and that collects their personal information. - **Physical presence**: offices, staff or property in California. Presence makes the answer easy, but the text does not make it a requirement. The thresholds interact with nexus. Threshold (B) counts California consumers or households, so an entity meeting it has a large California footprint by definition. Threshold (A), gross revenue above **$26,625,000** in the preceding calendar year as CPI-adjusted since 2025-01-01, is not confined to California revenue, so a large out-of-state company with a small California customer base can meet it. For that company, nexus carries the whole weight of the scoping decision. ## The wholly-outside-California exemption Even for an entity that is a business, `1798.145(a)(1)(G)` says the title's obligations do not restrict its ability to **collect, sell or share** a consumer's personal information if **every aspect** of that commercial conduct takes place wholly outside California. The text spells out 'wholly outside' as three conditions, all required: 1. The business **collected** the information **while the consumer was outside California**. 2. **No part of the sale** of the personal information occurred in California. 3. **No personal information collected while the consumer was in California is sold.** The test is about **location at the time of the conduct**, not residence. A California resident is a consumer wherever they are; the exemption asks where they were when the data was collected and where any sale happened. ## Where the exemption stops - **Reproductive-health data.** Under `1798.145(a)(2)(A)`, subdivision (a) as a whole, including this carve-out, does not apply if the personal information contains information related to accessing, procuring or searching for contraception, pregnancy care or perinatal care services, including abortion services. - **Mixed datasets.** A dataset built from collection both inside and outside California fails the third condition as soon as any of the in-state collection is sold. - **Only the listed conduct.** The carve-out covers collecting, selling and sharing; it is not a general statement that the business is outside the title. ## Applying it: an out-of-state resort A Nevada ski resort, for-profit and above the revenue threshold, sells lift passes online to Californians and advertises in California. On most readings it is doing business in California. | Data | Where collected | Sold? | Carve-out applies? | |---|---|---|---| | Online pass purchase by a Californian at home | California | No | No | | Lift-gate scan of a Californian in Nevada | Outside California | No | Yes | | The same scans, later sold to a buyer in California | Outside California | Part of the sale in California | No | ## The engineering consequence The carve-out is usable only if systems record **where collection happened**, not just the consumer's home address, and many data models do not capture that. Without the attribute, a business cannot show that the conduct was wholly outside California and should treat the data as in scope. Nexus itself belongs in the scoping record too: the facts relied on, and the date they were assessed, so the decision can be revisited when the company starts selling or marketing into California.
- An out-of-state company has $200 million gross revenue and a few hundred California customers. Can it be a CCPA business?Potentially yes. The revenue threshold in Civil Code 1798.140(d)(1)(A) is not confined to California revenue, so it is met; the open question is whether the company does business in California. Real sales to California residents point toward nexus, so the undefined nexus element, not the thresholds, decides the case.
- Why can data about seeking abortion services never use the wholly-outside-California carve-out?Civil Code 1798.145(a)(2)(A) says subdivision (a) does not apply if the consumer's personal information contains information related to accessing, procuring or searching for contraception, pregnancy care or perinatal care services, including abortion services. The carve-out sits in subdivision (a)(1)(G), so it falls away for that data.
saying these in an interview costs you the question
- Says a company needs an office or staff in California to be covered
- Quotes a statutory definition of 'doing business in California' the title lacks
- Thinks hosting servers outside California makes processing wholly outside the state
- Applies the carve-out to data collected online from Californians at home
- Ignores the reproductive-health exception to the subdivision (a) carve-outs