Business (1798.140(d))

A "business" under the California Consumer Privacy Act and California Privacy Rights Act is any for-profit or nonprofit legal entity that determines the purposes and means of processing personal information of California residents, and that meets at least one statutory threshold such as annual gross revenues over $25 million, possession of personal data for 50,000 or more consumers, households or devices, or derives 50 percent of its annual revenue from selling personal information. The definition also applies to subsidiaries and service providers acting on its behalf.