Scope and Thresholds

## Why the scoping question comes first Under the CCPA as amended by the CPRA (Civil Code 1798.100 et seq.), almost every duty is imposed on a **business**. Consumer rights, notices and opt-outs attach to a business, so the first question in any CCPA analysis is whether the organisation is one. The definition lives in Civil Code `1798.140(d)` and has two layers: **cumulative elements** every business must have, and **alternative thresholds** of which one is enough. ## The cumulative elements of 1798.140(d)(1) An entity is a business under paragraph (1) only if all of these hold: 1. **Legal form and purpose.** It is a sole proprietorship, partnership, limited liability company, corporation, association or other legal entity **organised or operated for the profit or financial benefit** of its shareholders or other owners. 2. **Collection.** It collects consumers' personal information, or the information is collected on its behalf. 'Collects' in `1798.140(f)` is broad: buying, renting, gathering, obtaining, receiving or accessing personal information by any means, including by observing behaviour. 3. **Decision-making.** Alone or jointly with others, it **determines the purposes and means** of processing that personal information. 4. **California nexus.** It **does business in the State of California**. 5. **A threshold.** It satisfies **one or more** of the three thresholds below. A **consumer** in `1798.140(i)` is a natural person who is a California resident (the residence test is borrowed from a California tax regulation), however identified, including by a unique identifier. That is why the analysis counts Californians, not every user. ## The three alternative thresholds | Threshold | What 1798.140(d)(1) says | What to check | |---|---|---| | (A) Revenue | Annual gross revenues above $25,000,000 in the preceding calendar year, as of January 1, as adjusted under `1798.199.95(d)` | Since 2025-01-01 the adjusted figure is **$26,625,000** | | (B) Volume | Alone or in combination, annually buys, sells or shares the personal information of **100,000 or more** consumers or households | Buying, selling and sharing count; mere collection does not | | (C) Data revenue | Derives **50 percent or more** of annual revenues from selling or sharing consumers' personal information | Catches a data broker even with small revenue | The word that decides most interview answers is **'or'**: the text says 'one or more of the following thresholds'. A for-profit company doing business in California with $3 million in revenue that sells or shares data on 120,000 Californians a year is a business; so is a data broker with $5 million in revenue that earns most of it from selling personal information. ## Who is pulled in beyond paragraph (1) Paragraphs (2) to (4) extend the definition: - **Affiliates under common control and common branding** (`1798.140(d)(2)`): an entity that controls or is controlled by a business, shares **common branding** with it (a shared name, servicemark or trademark that the average consumer would understand as common ownership), and with whom the business shares consumers' personal information. Control means more than 50 percent of the voting shares of any class, control over electing a majority of directors, or a controlling influence over management. Paragraph (2) does not repeat the for-profit element or the thresholds. - **Joint ventures** (`1798.140(d)(3)`): a joint venture or partnership composed of businesses that each hold **at least a 40 percent interest** is itself a business, considered separately from its members. - **Voluntary certification** (`1798.140(d)(4)`): a person doing business in California that is not otherwise covered may certify to the California Privacy Protection Agency that it complies with the title and agrees to be bound by it. ## Who usually falls outside - A **charitable non-profit** that is not organised or operated for its owners' profit is not a business under paragraph (1), however many Californians are on its donor list, unless paragraph (2) or (4) reaches it. - A **government agency** does not fit the paragraph (1) list of entities run for their owners' profit or financial benefit. - A for-profit company that **meets no threshold** is outside, however it treats data. - Data inside a **statutory exemption** (health information governed by the CMIA or HIPAA, data subject to the Gramm-Leach-Bliley Act and others in `1798.145`) is out of scope even when the entity is a business. That is a data-level question, asked after the entity-level one. ## How to answer in an interview Walk the test in order: for-profit, collects, decides purposes and means, does business in California, then the thresholds, stopping at the first one met. Name the adjusted revenue figure rather than the statutory $25 million and say from when it applies. Then say what the answer does not settle yet: the exemptions, and the separate question of which duties follow once the entity is in scope.