Under the CCPA, a mobile game has 150,000 California players and earns nothing from their data — does the 100,000-consumer threshold make it a business?
answer
- count the verbs, not the users
- collecting is not the trigger
- buys, sells or shares
- sharing needs no payment
basics
~20 sNot by user count alone. Civil Code 1798.140(d)(1)(B) is met by buying, selling or sharing personal information of 100,000 or more California consumers or households a year; passing ad identifiers to third parties for cross-context advertising would count.
solid answer
~40 sThreshold (B) in Civil Code `1798.140(d)(1)(B)` turns on what the game **does** with the data: it must annually **buy, sell or share** the personal information of 100,000 or more consumers or households. Collecting data from 150,000 players and keeping it in-house does not meet it. But if the game discloses players' identifiers to third parties for **cross-context behavioural advertising**, that is 'sharing' under `1798.140(ah)` even with no payment, and 150,000 California players clears the bar. Only California residents count, because a consumer is a California resident. Threshold (C) can never be met on these facts, since the game earns nothing from selling or sharing data, but threshold (A) still applies if gross revenue in the preceding calendar year exceeded **$26,625,000**.
go deeper
Remember that threshold (B) is about buying, selling or sharing personal information of 100,000 or more California consumers or households a year, not about how many users you have.
Explain why unpaid disclosure to ad networks for cross-context behavioural advertising is sharing, and how that one integration can decide whether the whole company is a business.
Show how you would build the evidence: an inventory of outbound SDK and server-side flows, counted yearly per California consumer or household, with the other thresholds checked independently.
Weigh the product trade-off: keeping cross-context advertising for California players brings the company into scope, while removing it changes revenue; that decision belongs to product and legal together.
## The threshold in the text Civil Code `1798.140(d)(1)(B)` makes an otherwise-qualifying for-profit entity a CCPA business if it, 'alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households'. Three parts of that sentence decide the mobile-game case: the **verbs**, the word **consumers**, and **annually**. ## Collecting is not the trigger The verbs are **buys, sells or shares**. A game that collects account data, gameplay telemetry and device identifiers from 150,000 California players and keeps all of it in-house has collected a great deal of personal information, but collection is not one of the listed verbs. On those facts alone, threshold (B) is not met. - **Sell** (`1798.140(ad)`) means disclosing or making available a consumer's personal information to a third party for monetary or other valuable consideration. - **Share** (`1798.140(ah)`) means disclosing it to a third party **for cross-context behavioural advertising, whether or not for monetary or other valuable consideration**. - **Buying** personal information from others is also 'collection' under `1798.140(f)`, and it counts toward (B). Exactly where a given data flow falls between these terms is its own subject; for scoping, the point is that only these flows count. ## Where the game crosses the line Many free-to-play games embed advertising software. If the game discloses players' mobile advertising identifiers or other personal information to third parties so that ads can be targeted using their activity across other apps and sites, that is **sharing**, and no money needs to change hands. Personal information includes unique identifiers, and `1798.140(aj)` names mobile ad identifiers among them. Once the game shares data of 100,000 or more California consumers or households in a year, threshold (B) is met and the game is a business. | Facts about the game | (A) revenue | (B) volume | (C) data revenue | Business? | |---|---|---|---|---| | Keeps all data in-house, $4M revenue | No | No | No | No | | Shares ad identifiers of 150,000 Californians for cross-context ads, $4M revenue | No | Yes | No | Yes | | Keeps data in-house, $30M gross revenue in the preceding year | Yes | No | No | Yes | ## Counting correctly 1. **Count Californians only.** A consumer is a natural person who is a California resident (`1798.140(i)`), so players in other states do not count. 2. **Consumers or households.** A **household** (`1798.140(q)`) is a group of consumers who live at the same residential address and share common devices or services. Either unit counts toward the figure. 3. **Annually.** The test is a yearly volume, not a lifetime total of accounts ever created. 4. **In combination.** The text counts consumers or households whose information is bought, sold or shared; read naturally, the three verbs add up toward one figure rather than each needing 100,000 on its own. ## Why the other thresholds do not settle it Threshold (C) needs **50 percent or more** of annual revenue to come from selling or sharing personal information. A game that earns nothing from data can never meet it, even if it shares data for free. Threshold (A) depends only on gross revenue in the preceding calendar year above the CPI-adjusted figure, **$26,625,000** since 2025-01-01, and is independent of what the game does with data. If (A) is met, the volume question no longer decides whether the game is a business. ## The design consequence For an engineer, the practical output is an inventory of **outbound data flows** from the app and its servers: every advertising, attribution and analytics integration, which identifiers it receives, and for what purpose. Whether the company is a business at all can turn on one integration. Turning off cross-context behavioural advertising for California players changes the count; so does the question of which recipients are 'third parties' at all, which the statute answers in separate definitions. The count itself needs evidence: a yearly figure of distinct California consumers or households whose data left through a counting flow.
- Does a Californian who plays on three devices count as three consumers toward the threshold?No. The threshold counts consumers or households, not devices. A consumer is a natural person, however identified, including by a unique identifier, so three linked identifiers belonging to one player are one consumer. Where the game cannot link them, estimating the count honestly is a practical evidence problem, not a change in the legal test.
- If the game's gross revenue exceeded $26,625,000 last year, does the volume question still matter?Not for whether the game is a business: one threshold suffices, so revenue above the adjusted figure in the preceding calendar year settles it. The data-flow inventory still matters, because what the game sells or shares shapes the duties it owes once in scope.
A toll bridge counts the cars that cross it, not the cars parked in driveways. Personal information kept in-house is parked; information handed to an ad network for cross-context advertising crosses, whether or not a toll is paid.
saying these in an interview costs you the question
- Counts every registered user toward the 100,000 figure, whatever the state
- Thinks collecting data from 100,000 Californians alone meets the volume threshold
- Believes nothing is sold or shared unless the recipient pays money
- Treats a mobile advertising identifier as non-personal technical data
- Assumes a game with no data revenue cannot be a CCPA business