privacy california ccpa
Definition of a Household or Device in the context of the California Consumer Privacy Act (CCPA)
<p>The California Consumer Privacy Act (CCPA) applies to a business if it meets one of:</p>

<ul>
<li>Has annual gross revenues in excess of twenty-five million dollars...</li>
<li>Alone or in combination, annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, <strong>households</strong>, or <strong>devices</strong>.</li>
<li>Derives 50 percent or more of its annual revenues from selling consumers’ personal information.</li>
</ul>

<p>It also defines that <em>"Consumer means a natural person who is a California resident"</em>.<br>
The term Household is not explicitely defined.<br>
Is it safe to assume that the term Household is limited to households composed of California residents?</p>

<p>Similarly, Device is defined as <em>"means any physical object that is capable of connecting to the Internet, directly or indirectly, or to another device."</em>
Is it safe to assume that the device must belong to a California resident?</p>

<p>There are also regulations to go with the bill passed by the legislature. The <a href="https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-proposed-regs.pdf" rel="nofollow noreferrer">proposed regulations</a> are open for comment until Dec. 6 2019. In the regulations, "Household" is given a definition (§999.301(h)): </p>

<blockquote>
  <p>“Household” means a person or group of people occupying a single
  dwelling</p>
</blockquote>

<p>You can't add anything to that: the persons do not have to be California residents, and the household does not have to be in California. When you real the <a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375" rel="nofollow noreferrer">text of the law</a>, you will see that consumers (which by definition must be California residents) have rights to do things, and households do not. So a household cannot demand, but a consumer may – but the rights of the consumer may relate to information that "is linked or reasonably linkable to a consumer or household". </p>

<p>Many California users do not own the device that connect them to the internet, but they are not unprotected (consider for example the person who rents their cable modem from their ISP). Ownership of the device is not a requirement for protection of privacy, under this law. Basically, "device" means "device", not some sub-set of devices.</p>

<p>The definition of "Business" does not say that the computation of threshold values is "only with respect to California". §1798.194 says that "This title shall be liberally construed to effectuate its purposes". Limiting which businesses are subject to the provisions of the law would not effectuate the purpose of the law. So in case of imaginable unclarity (such as the omission of a restriction "provided such devices are owned by residents of California"), the law is not to be narrowly interpreted (as applying only to businesses that deal in information of at least 50,000 <em>California</em> devices), it is to be interpreted liberally. The purpose of the threshold values is to not excessively burden "small businesses". A business with 1,00,000 customers that has only 40,000 California customers is not a small business, it is a big business with a small presence in California.</p>

<p>Since there are 6 weeks left on the rule-making process, it is possible that the regulations will change and the AG will interpret the statutory requirement as saying that the numbers of households, devices, or income threshold are only that which comes from or is in California. I am betting that that will not happen.</p>
