ANALYSIS: Think You’re Outside the Scope of CCPA? Think Again

A little-noticed provision in a recent amendment to the California Consumer Privacy Act (CCPA) extends a sliver of the Act’s reach beyond those who satisfy the statutory definition of a “business.” Yes, the new provision applies even to nonprofits and to organizations with annual gross revenues below $25 million.

Kudos to Ann Waldo, a solo practitioner in D.C., who highlighted this anomaly Wednesday at the Virtual Privacy + Security Forum.

AB 713, which was approved by Gov. Gavin Newsom Sept. 25, aligns certain CCPA exemptions with the federal Health Insurance Portability and Accountability Act (HIPAA). ...