Like many laws, CISPA would have an effect on people who are not citizens of the U.S. That is why many laws use terms like "consumer" in the context of business, "patient" in the context of health care, or often just "person" otherwise.

Words matter; "citizen" is a more restrictive class of people than "consumer."