Does the CCPA apply to B2B businesses?

Yes, the California Consumer Privacy Act (CCPA) can apply to B2B businesses. A company does not avoid the CCPA simply because it sells products or services to other businesses rather than directly to consumers. The temporary exemption for personal information collected in certain business-to-business interactions expired on December 31, 2022. Since January 1, 2023, personal information relating to California residents in a B2B context may be covered by the CCPA.

For example, this may include personal information collected about a client’s employees, representatives, contractors, or other business contacts. However, the CCPA applies to personal information about individuals, not information relating solely to a company or legal entity.

A B2B company must still meet the applicable CCPA business thresholds before it is considered a covered business. If it does, it may need to provide appropriate privacy notices and support consumer privacy rights, such as access, deletion, correction, and opt-out rights. Service providers and contractors that process personal information for covered businesses may also have separate obligations under the CCPA.