Lumenwise: Thresholds, Pixels, and Employee Data in California
Lumenwise is a Texas-based B2B software company with $60 million in annual revenue. It has 900 California employees and applicants, 15,000 California business contacts, and a marketing site receiving 140,000 unique California visitors per month. The site runs a Meta pixel that sends hashed email addresses and browsing events to Meta for retargeting, and it has a 'Share to LinkedIn' button. Lumenwise does not sell customer data for money, has no 'Do Not Sell or Share My Personal Information' link, and does not honor Global Privacy Control signals. It processes precise geolocation and Social Security numbers for its 900 employees. A vendor contract labels one partner a 'processor.'
1. Does the CCPA/CPRA apply to Lumenwise? Walk through the thresholds and the B2B/employee issue.
Read the worked answer
The thresholds are disjunctive: a for-profit doing business in California that meets any one of (1) at least $25 million in gross annual revenue, adjusted annually for inflation; (2) buying, selling, or sharing personal information of 100,000 or more consumers or households; or (3) deriving 50% or more of annual revenue from selling or sharing personal information.
Lumenwise meets prong one at $60 million, so the analysis ends there - the 140,000 monthly visitors and the size of the contact database are irrelevant to coverage, though they matter to the scope of duties.
The critical point is temporal: the B2B and employee/applicant exemptions sunset on January 1, 2023. The 900 employees and 15,000 business contacts are therefore 'consumers' today, entitled to notice at collection, purpose limitation, and rights to know, delete, correct, opt out, and limit sensitive personal information. Lumenwise's workforce data practices are now fully in scope, and 'we're a Texas B2B company' is not a defense - doing business in California through employees and marketing is enough.
2. Is the Meta pixel a 'sale' or 'sharing' even without payment? What must change?
Read the worked answer
Yes. CPRA 'sharing' (§1798.140(ah)) covers communicating a consumer's personal information to a third party for cross-context behavioral advertising, for monetary or other valuable consideration. Retargeting is the paradigm case: valuable consideration includes non-cash benefit, and the value here is advertising reach.
Hashed email addresses do not escape: hashed identifiers remain personal information under the CPRA where they can be linked to a consumer or device, and the browsing events plus device signals are independently identifiable.
Required changes:
- Add a clear 'Do Not Sell or Share My Personal Information' link and disclose sharing in the notice at collection and privacy policy.
- Honor opt-out preference signals, including Global Privacy Control - the regulations make this mandatory, and failure to detect GPC is one of the most-cited enforcement facts.
- Treat Meta as a third party, not a service provider. It uses the data for its own purposes, so a service-provider contract cannot launder the transfer; the contracts with the 'processor'-labeled vendor also fail unless the statutory terms under §1798.100(d) and §1798.140(ag) actually constrain the vendor's use.
- Reassess the LinkedIn share button if it enables cross-context behavioral advertising.
3. The precise geolocation and SSNs come from employees. How does the sensitive-personal-information right apply, and what is the enforcement backdrop?
Read the worked answer
Precise geolocation and Social Security numbers are 'sensitive personal information' (§1798.140(ae)). Consumers may direct a business to limit use and disclosure of sensitive PI to purposes necessary to perform the services or provide the goods reasonably expected.
For employment data, several of those permitted purposes apply: payroll, tax reporting, benefits administration, and security are uses a consumer would reasonably expect from an employer, so the right to limit does not bar them. What it does reach is secondary use - sending employee geolocation to a wellness vendor, or repurposing SSNs for identity verification of marketing leads. Lumenwise should map each sensitive-PI flow to a permissible purpose, publish an HR notice at collection, and restrict onward disclosure.
Enforcement: the CPPA and the Attorney General may act directly; the CPRA eliminated the mandatory 30-day cure, with administrative fines up to $2,500 per violation and $7,500 for intentional violations or those involving minors. The private right of action is narrow - data breach only, $100–$750 per consumer per incident - but that is precisely the risk created by unmanaged vendor flows.