SACRAMENTO – During a recent panel discussion regarding the California Consumer Privacy Act (CCPA), John Kabateck, California state director for the National Federation of Independent Business, explained that one component of the law may affect a large number of small businesses: the collection of 50,000 pieces of consumer data.
"Kabateck said the 50,000 breaks down to 137 transactions a day, which 'could very well be a restaurant in Napa or a food truck in Los Angeles if they retain consumer information for use,'" according to a NFIB press release.
NFIB is just one organization out of many across the state that believe that small businesses in particular will be hammered by the bill in one way or another – and some will have no idea that it’s even coming.
“I think it’s truly difficult to say how many businesses may be impacted,” said NFIB attorney Luke Wake. “We identify some examples that we think will rope-in a lot of businesses that likely have no idea that they now have new regulatory requirements to work with.”
According to Wake, regardless of where a business is located, any company doing business with California consumers must comply with the CCPA if any of the following are true: The company has annual gross revenues of more than $25 million; the company collects personal information from 50,000 or more consumers, devices or households; and the company makes 50 percent of more of its annual revenues from selling consumers’ personal information.
“Since most small businesses report gross sales of only about $500,000 a year, it’s most likely that you are unaffected by CCPA unless you collect personal information from 50,000 or more ‘consumers, households, or devices’ in a given year,” said Wake. “But while that sounds like a high threshold, it breaks down to roughly 137 transactions a day. For example, a food truck operating in California might be covered if it retains consumer information for use in a rewards program. Other companies might be affected if they have a large email distribution list for promotional offers. And out-of-state companies might be subject to CCPA if they collect personal information through user accounts or cookies.”