Startups And Small Businesses Should Not Fear The California Consumer Privacy Act (Ccpa)

Mitchell C. ShelowitzManaging Partner, SLG Shelowitz Law Group

In the aftermath of the onerous implementation requirements of the GDPR for companies doing business in the European Union, many global businesses are rightfully concerned about the potential costs of compliance, business interruption, and risks related to The California Consumer Privacy Act of 2018 (the “CCPA”), which officially went into effect on January 1, 2020. See Cal. Civ. Code §§ 1798.100 – 1798.199.

However, fears about the CCPA may be misplaced.  In fact, the CCPA is inapplicable to most startups and small companies.

In general, the only businesses that are required to comply with the CCPA are those that do business in California, which:

i. have annual gross revenues in excess of twenty-five million dollars ($25,000,000); and/or

ii. alone or in combination, annually buy, receive for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; and/or

iii. derive 50 percent or more of its annual revenues from selling consumers’ personal information.

See Cal. Civ. Code §1798.140(c).*

Therefore, if your business (i) does not engage in business activities in California; or (ii) does not meet any of the above thresholds either directly or indirectly, then have no fear.

—-

*Franchises and other businesses owned or controlled by companies that meet the above thresholds may be subject to the CCPA if they operate under the same brand, trademark or service mark.  See §1798.140(c)(2).  

SLG provides a comprehensive, one-stop approach to the world of privacy law.  SLG lawyers assist clients in conducting internal investigations, identifying potential areas of improvement, and developing policies to ensure compliance with the numerous U.S. privacy laws and regulations.  For inquiries or more information about SLG’s Intellectual Property Protection and Privacy Practice, please see: https://www.shelgroup.com/practices/ip-protection-and-privacy.

This article is provided for information purposes only and does not constitute legal or other advice.