Under the CCPA as amended by the CPRA, are a business's California employees and B2B contacts 'consumers' whose personal information the law now covers?

## Who is a consumer Civil Code `1798.140(i)` defines a **consumer** as 'a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations, as that section read on September 1, 2017, however identified, including by any unique identifier'. The residence test is borrowed from a California tax regulation. Nothing in the definition asks **in what capacity** the person deals with the business: a shopper, an employee, a job applicant and a supplier's sales representative are all consumers if they are California residents. ## The two exemptions that expired The original CCPA carved two groups out, temporarily: | Exemption | Civil Code | What it covered | Status | |---|---|---|---| | Employee | `1798.145(m)` | Personal information of job applicants, employees, owners, directors, officers, medical staff members and independent contractors, collected and used solely in that role; their emergency contacts; information needed to administer benefits for another person, such as a dependant, through their role | Inoperative since 2023-01-01, under `1798.145(m)(4)` | | B2B | `1798.145(n)` | Communications and transactions with a natural person acting for another company, partnership, sole proprietorship, non-profit or government agency, in due diligence or in providing or receiving a product or service | Inoperative since 2023-01-01, under `1798.145(n)(3)` | Both subdivisions are still printed in the Code, each with its own sunset clause; the section's history note records that subdivisions (m) and (n) became inoperative on January 1, 2023 by their own provisions. They were never complete even while they ran: - The employee exemption **did not** reach the duty to inform consumers at or before collection in `1798.100(a)`, or Section `1798.150` (`1798.145(m)(3)`). - The B2B exemption named the sections it switched off (`1798.100`, `1798.105`, `1798.106`, `1798.110`, `1798.115`, `1798.121`, `1798.130` and `1798.135`); `1798.120` was not among them. ## What that means today Since 2023-01-01, a business must treat its California workforce and its California business contacts as consumers: 1. **HR systems**, such as applicant tracking, payroll, benefits, performance records and badge or device logs, hold consumer personal information. 2. **CRM and sales systems** hold the names, work emails, call notes and meeting history of business contacts who are California residents. 3. **Emergency-contact and beneficiary records** hold personal information of people who may never have dealt with the business directly. Whether the organisation is a business at all is still decided by the `1798.140(d)` test, which looks at the employer's revenue and data flows, not at the employee. And data that sits under another exemption, such as health information governed by the CMIA or HIPAA, remains exempt for that separate reason. ## The residence edge Because 'consumer' turns on California residence: - A remote employee who lives in another state and is not a California resident is **not** a consumer, even if the employer is headquartered in California. - A California resident working for an out-of-state company that meets the business test **is** a consumer. - The engineering consequence: HR data needs a reliable **residence** attribute. Office location, payroll entity or headquarters is the wrong field to filter on. ## Why the question is asked Data maps, retention schedules and vendor questionnaires written while the exemptions ran may still mark HR and B2B data 'out of CCPA scope'. The question tests whether a candidate knows the law as it now stands, as amended by the CPRA and after the sunsets, and can say what the change does to systems that were never built with consumer requests in mind: HR platforms, sales tools and shared inboxes now sit inside the inventory a business must be able to search, and the personal information about staff in them is personal information like any other.