The California Consumer Privacy Act (CCPA) takes effect on January 1, 2020. When it does, it will be the strictest privacy law in the country, and may be a model for other states as well.
The CCPA applies to any for-profit entity that does business in California, collects the information of California consumers and satisfies any one of the following three criteria: (1) has more than $25 million in annual revenue; (2) collects the information or 50,000 or more consumers, households or devices; or (3) derives more than half of its income from the sale of consumers’ personal information. Although the statute lacks any definition of “doing business in California,” it is not a requirement that the business be a California entity or have its principal operations in the state. If a business would be subject to personal jurisdiction in California based on its activities within the state (including, for example, recruitment and advertising), it is likely that the CCPA would apply. The statute also specifically grants rights to California consumers, which would include California students attending out-of-state schools.
Many of the country’s for-profit schools will be subject to the CCPA based on either the annual revenue or number-of-records-collected provisions (or both). These entities will need to comply with all of the CCPA’s provisions, and, if they haven’t already, must take immediate steps to comply.