From another California regulation (requiring telemarketers to register and secure a bond):

A seller is deemed to be doing business in the state if the seller solicits prospective purchasers from locations in California or solicits prospective purchasers who are located in this state.'

<https://oag.ca.gov/consumers/general/telreg>

The DROP act creates a right to California residents. To the extent I've read the statute, it doesn't define what entities are covered (see: <https://leginfo.legislature.ca.gov/faces/codes_displayText.x...>), which seems to me to suggest that affected entities are defined by their data collection from California residents, not where or how they engage in activities otherwise in California.

Doing business is doing business, money isn't necessary to "do business". If you hold any interest and that person has any relationship with you in a way that can be inferred that a contract is implied, then that's business. That's why travel to get an "agreement" is considered a business expense, even if the agreement never materialize.

If you've collected data on a California resident with the intent to profit from its sale then you're doing some type of business with respect to California

I’m not sure the definition matters here. Either you are doing business and this regulation makes certain things now illegal; or you are not doing business and it’s unsolicited and spam.