From another California regulation (requiring telemarketers to register and secure a bond):

A seller is deemed to be doing business in the state if the seller solicits prospective purchasers from locations in California or solicits prospective purchasers who are located in this state.'

<https://oag.ca.gov/consumers/general/telreg>

The DROP act creates a right to California residents. To the extent I've read the statute, it doesn't define what entities are covered (see: <https://leginfo.legislature.ca.gov/faces/codes_displayText.x...>), which seems to me to suggest that affected entities are defined by their data collection from California residents, not where or how they engage in activities otherwise in California.