As businesses have scrambled to obtain compliance with the California Consumer Privacy Act (CCPA) in recent months, questions surrounding its constitutionality have arisen. As a broad, sometimes unclear state law that imposes significant obligations on businesses around the country, CCPA may be ripe for legal challenge. The strongest bases for such challenges appear to be: (1) that CCPA violates the “Dormant Commerce Clause”; and (2) that CCPA is impermissibly vague.

Dormant Commerce Clause

The burden that CCPA imposes on out-of-state economic activity may place it in violation of the Dormant Commerce Clause, a legal doctrine created out of the Commerce Clause of the US Constitution. The Commerce Clause allows the US Congress to regulate interstate commerce; from this grant of power, courts have inferred a limitation on the authority of states to regulate interstate commerce, a doctrine coined the Dormant Commerce Clause. On this basis, courts will strike down state laws that explicitly discriminate against out-of-state actors or that regulate activity that occurs entirely outside of the state. In addition, the Dormant Commerce Clause prohibits laws that do not explicitly discriminate against out-of-state economic interests if the effect of a law is to unduly burden interstate commerce. If a state law does unduly burden out-of-state interests, a court will typically balance the burdens imposed on interstate commerce against the benefits the law creates for the state to determine whether or not the law should be upheld.

While CCPA does not explicitly discriminate against out-of-state economic actors, it does impose a burden on interstate commerce that a court could determine is undue. CCPA applies to businesses that “doing business” in California that meet certain financial or personal information collection or sale thresholds. CCPA even extends to entities that merely control or are controlled by businesses subject to CCPA. Therefore, CCPA applies to out-of-state entities that have only tenuous connections to California and its economic interests, and will likely have a significant impact on interstate commerce. In addition, the burden imposed on individual businesses by CCPA can be substantial; businesses may have to, among other measures, overhaul their data collection, retention, processing and sharing practices and hire dedicated staff for CCPA compliance. In order to determine the constitutionality of the CCPA, a court may have to balance these burdens against the benefits that CCPA generates for California consumers.

Vagueness

Another significant potential avenue for challenging CCPA is the law’s vagueness. The scope and meaning of several key terms in CCPA are vague and broad, which may render the law unconstitutional under the so-called vagueness doctrine. Under that doctrine, federal courts can invalidate a law for vagueness if an ordinary person cannot determine who and what a law regulates, or if the law is overly broad, typically because key terms are not well defined.

CCPA may be both unconstitutionally vague and overbroad, particularly as it defines “personal information.” “Personal information” is defined to include all information that is “reasonably capable” of being associated with, directly or indirectly, a consumer or a household. Examples of personal information in the text of the law include internet browsing and search history, information regarding a consumer’s interaction with a website, and thermal and olfactory information. This definition may not be detailed enough to allow businesses to determine what constitutes personal information, since an ordinary person may not be able to distinguish information that is “reasonably capable” of being associated with a consumer from information that is not. In addition, the definition of personal information may be overbroad; nearly all information about consumers is “reasonably capable” of being indirectly associated with an individual or a household, making the scope of the law almost limitless.

What Does It Mean?

The Dormant Commerce Clause and the vagueness doctrine are just two bases upon which CCPA could be challenged. Many other bases, such as a challenge on First Amendment grounds, have also been discussed by observers. Given the many questions that still surround the application of CCPA and the significant burdens the law places on regulated businesses, interest in challenging the constitutionality of the law will undoubtedly be high. Several large companies and trade groups have already expressed misgivings about some of the law’s provisions, and may choose to have their concerns resolved by the courts.

In the interim, however, CCPA remains valid law. Businesses subject to CCPA should ensure that that they have implemented policies and procedures for compliance with the law.