---
title: Does the CCPA Apply to Businesses Outside of California?
description: The CCPA applies to businesses with users or customers in California, even if they have no physical presence in California and do business entirely online.
image: https://safe.truevault.com/hubfs/california-consumer-privacy-act-keyboard.jpg
---
- [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa)
- [GDPR Compliance](https://safe.truevault.com/gdpr-guide)
- [HIPAA](https://safe.truevault.com/learn/hipaa)
- [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html)
- [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii)
- [PHI](https://safe.truevault.com/protected-health-information)
- [Resources](https://safe.truevault.com/learn/)
- Login
[TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com)
- [Resources](https://safe.truevault.com/learn/)
- Login
- Login
- [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com)
- [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com)
[Blog](https://safe.truevault.com/blog)
- [Home](https://www.truevault.com/index.html)
- [Blog](https://safe.truevault.com/blog)
# Does the CCPA Apply to Businesses Outside of California?
By Sarah Edri/ Published on October 21, 2020
Some businesses assume that if they do not have a storefront or office in California, the California Consumer Privacy Act of 2018 (“CCPA”) does not apply to them. That assumption is not only wrong, it could result in regulatory inquiries and monetary penalties.
The CCPA does not require a physical presence in California. If your business is located outside of California but engages in transactions with Californians for the purpose of financial gain – such as offering goods or services – then the CCPA could apply to you. If your business collects any information from California residents – such as through an online website – then the CCPA likely does apply to your business unless it does not meet one of the three thresholds in the law.
The CCPA applies to any business that meets **one or more** of the following thresholds:
- Has annual gross revenues of more than $25 million
- Buys or sells, or receives or shares for a commercial purpose, the personal information of 50,000 or more California residents
- Derives 50% or more of annual revenues from selling personal information
The CCPA does not regulate commercial conduct that occurs wholly outside of California. However, it is rare today for every part of commercial activity to occur entirely outside of the most populous state in the country. If you’re a for-profit business that operates an online website and that collects any information about California residents – such as IP addresses of web visitors – you should determine whether you meet any of the CCPA’s thresholds and, if you do, come up with a compliance plan.
Even businesses that do not meet one of the thresholds could still be subject to regulation under the CCPA. If a business shares common branding with a company it controls – or that is controlled by it – and that company is subject to the CCPA, the business too is required to adhere to the CCPA, regardless of its revenue.
In short, a business’s lack of physical presence in California does not remove it from the CCPA’s purview. If your business offers goods or services to Californians and collects any personal information from them, the CCPA will apply to your business if it meets one of the thresholds in the law – or shares branding with a business that does.
[](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/73a33362-e1a8-4c20-b594-5ea457730cf2)
### Latest Posts
## [Should Utah's Privacy Law Be on Your Radar?](https://safe.truevault.com/blog/utah-privacy-law-does-it-apply)
Phillip Walters / November 17, 2022
## [Connecticut’s Privacy Law: Does It Apply to Your Business?](https://safe.truevault.com/blog/connecticut-privacy-law-does-it-apply)
Phillip Walters / November 10, 2022
## [Global Privacy Control: A New Requirement for Compliance](https://safe.truevault.com/blog/global-privacy-control)
Phillip Walters / November 7, 2022
## [A Cookie Banner Isn't Enough for CCPA Compliance](https://safe.truevault.com/blog/a-cookie-banner-isnt-enough)
Phillip Walters / October 27, 2022
## [Why CCPA Compliance Matters to HR](https://safe.truevault.com/blog/why-ccpa-matters-to-hr)
Phillip Walters / October 21, 2022
### Mailing List
### Company
- [Blog](https://safe.truevault.com/blog)
- [Contact Us](https://safe.truevault.com/contact-us-2019)
- [Careers](https://truevault.workable.com)
- [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html)
- [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/)
### Developers
- [Patterns](https://safe.truevault.com/patterns)
- [Documentation](https://docs.truevault.com/)
- [Quick Start Guide](https://safe.truevault.com/quick-start-guide)
- [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure)
- [API Overview](https://safe.truevault.com/api-overview)
### Latest Posts
### Contact Us
201 Mission Street, 12th Floor
San Francisco, CA 94105
Email: [hello@truevault.com](mailto:hello@truevault.com)
2024 © All Rights Reserved. [Privacy Policy](https://privacy.truevault.com/privacy-policy) | [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use) | [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)