Question 2: Does an employer need to generate revenue in California in order for CCPA to apply?

No.

The CCPA applies to “businesses,” a term that is defined, in part, as an entity that meets one of the following three thresholds:

  1. Annual gross revenue in excess of $25 million.
  2. Purchases, receives for commercial purposes, sells, or shares for commercial purposes, personal information of 50,000 or more consumers, or
  3. Derives 50% of annual revenue from selling consumer personal information.[1]

While these have yet to be interpreted by a court or in connection with the California Attorney General’s rulemaking process, the first revenue-oriented threshold that the statute does not specify whether the $25 million must be generated within the state of California.

Any business that meets one of these three thresholds and has California-based employees will be required to comply with the CCPA, as currently drafted.