Launch a small website and commit a felony in 7 states and 13 countries.
I wouldn't have known about the Mississippi bill unless I'd read this. How are we have to know?
If anything, communications between Mississippi and California would be interstate commerce and would thus fall under federal legal jurisdiction.
If I run a server in Utah primarily for myself, and you as a Californian happen to stumble upon it, should I have to abide by California privacy laws?
> should I have to abide by California privacy laws?
It seems these are the conditions:
As of January 1, 2023, your business must comply with both the CCPA and the CPRA if you do business in California and meet any one of the following conditions:
* Earned $25 million in gross annual revenue as of January 1 from the previous calendar year
* Annually buys, sells, or shares the personal information of 100,000 or more California consumers or households
* Derived 50% or more of your gross annual revenue from the selling or sharing of personal information
Also lots of states have their own data privacy laws.
https://iapp.org/media/pdf/resource_center/State_Comp_Privac...
And yes, in this particular circumstance for this specific law as currently written a private blog doing it's own normal things probably wouldn't infringe or be subject to these rules.
But what about a Utah focused social media site that does have $25M in revenue? It's not trying to court California users. Why should they have to be liable to laws in a state they never intended to do business in? It's these Californians leaving California to interact with an org across state lines. Whatever happened to state sovereignty? Should an Oklahoman be required to buy only 3.2% beer in Texas as well or have some Texas beer and wine shop face the wrath of Oklahoma courts for serving an Okie some real beer?
Where did that web transaction actually happen? On the client or on the server? Where did the data actually get stored and processed?
IMO we're past the time of patchwork laws. The social experiment of figuring out what makes some sense is largely over at least for the basics. It's time for real federal privacy laws to make a real, enforceable nationwide policy.
> It's not trying to court California users.
The point that is being made, is that even a site generally designed and expected to be used by Utah citizens can become liable to Californian law because a Californian created an account.
If you actually sell things to Californians that's different. At that point, yeah, I think you _should_ be subject to California law. You're doing the equivalent of mail order business with a resident after all.