Beware: The CCPA is not just for “consumers”

Don’t be too quick to decide that the California Consumer Privacy Act (CCPA) doesn’t apply to your small business funding company. It almost certainly does if you possess any non-public information of a California resident.

There has been plenty of buzz about the CCPA since its enactment in 2018. In the small business finance industry, many are quick to assume that any “consumer” laws or regulations won’t impact commercial funders. However, the CCPA is a major exception to this general rule. The CCPA broadly defines a “consumer” as any “natural person who is a California resident, as defined [by]…the California Code of Regulations…” Importantly, this definition does not consider the relationship of the “consumer” to the business, that provides the consumer with financing or other services. This is very different from many other laws that employ the standard definition of consumer products for financial services, which includes only products or services used for personal, family or household purposes. The applicable regulations define a “resident” as:

1. Every individual who is in California for other than a temporary or transitory purpose
2. Every individual who is domiciled in California who is outside California for a temporary or transitory purpose 

Accordingly, the CCPA applies to every California resident, whether or not the relationship with the business is commercial or consumer, so long as personal information of a resident of California is collected. In addition to a business’ customers, employees of a business or its vendors may also be deemed “consumers” under the CCPA. So, if you are collecting personal information of any resident of California, you are required to comply with the CCPA (assuming your business meets one of the following three thresholds for applicability:

1. It has annual gross revenues in excess of $25 million.
2. It, alone or in combination, annually buys, receives for the business’ commercial purposes, sells or shares for commercial purposes, the personal information of 50,000 or more consumers, households or devices.
3. It derives 50 percent or more of its annual revenue from selling consumers’ personal information. 

For more information about the CCPA, read an in-depth article here.