Much has been said about the scope of the California Consumer Privacy Act (CCPA) and the far-reaching implications the law will have on businesses throughout the United States. Although it is true that the territorial reach of the law is broad, it is not without limits. The CCPA explicitly includes a geographic exception that may be important in determining the applicability of the law to personal information processed by businesses that do not have a physical presence (including employees) in California.
CCPA Section 1798.145(a)(6) states that the obligations imposed by the law “shall not restrict a business’s ability to … [c]ollect or sell a consumer’s personal information if every aspect of that commercial conduct takes place wholly outside of California.” The statute provides that commercial conduct will be considered “wholly outside of California” where:
The exception includes a provision to prevent a potential “traveling Californian” loophole: Businesses may not store personal information about a California resident while the consumer is in California (such as on their mobile device), and then later “collect” that personal information when the consumer and stored personal information are outside of California.