CCPA / CPRA

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is California's main privacy law. It gives California residents rights over their personal information and applies to for-profit businesses that meet revenue or data-volume thresholds.

Compliance & PrivacyUpdated September 30, 2026

In short

CCPA/CPRA gives Californians rights to know, delete, correct and opt out of the sale or sharing of their data, and since 2023 it covers B2B contact data too.

Key points

  1. The law applies to for-profit businesses that do business in California and exceed a revenue threshold, handle data on 100,000 or more consumers or households, or earn half their revenue from selling or sharing personal information [1].
  2. The revenue threshold started at 25 million dollars and is adjusted for inflation every two years; the CPPA set it at 26,625,000 dollars from January 1, 2025 [1][4].
  3. The exemption for business-to-business contact data expired on December 31, 2022, so a prospect's work email and title are now covered Personal Data [1].
  4. Consumers have rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive information, similar in spirit to the Right to Erasure under GDPR [1][2].
  5. The CCPA is not an email consent law: Cold Email rules in the US come mainly from the CAN-SPAM Act, while the CCPA governs how contact data is collected, used and shared [1][3].
  6. Enforcement sits with the California Attorney General and the California Privacy Protection Agency, which has had enforcement authority since July 1, 2023 [1][4].

Who the CCPA applies to

The CCPA took effect on January 1, 2020, and the CPRA amendments, approved by voters as Proposition 24, took effect on January 1, 2023 [1]. A business is covered if it is for-profit, does business in California and meets any one of three tests: annual gross revenue above the adjusted threshold, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving at least 50% of annual revenue from selling or sharing personal information [1][3]. Many early-stage startups fall below all three. Service providers acting for a covered business still take on contractual duties, which is similar to the role of a Data Processing Agreement (DPA) under European law. Note that the definition of consumer is any California resident, including someone acting in a work role.

What changed for B2B data

Until the end of 2022, personal information about employees and business contacts had a partial exemption. That exemption expired on December 31, 2022 [1]. Since then, a Prospect who lives in California has the same rights over their work contact details as any consumer. A covered business that keeps a Lead List or a CRM (Customer Relationship Management) with California contacts should be able to tell people what it collects and why, honor requests to delete or correct data, and stop selling or sharing data when asked [2]. Information that is lawfully made available in government records, or that the consumer has made available to the general public, is excluded from the definition of personal information, but that carve-out is narrower than it sounds; see Publicly Available Data [3].

Rights, notices and practical steps

The CCPA requires a privacy notice at or before the point of collection, a privacy policy updated at least once a year, and at least two methods for submitting requests in most cases [1][2]. Businesses generally must respond to requests to know, delete or correct within 45 days. The right to opt out of sale or sharing is separate from an email Opt-Out: one stops data flows to third parties, the other stops messages. For outbound teams, sensible steps are to practice Data Minimization, avoid selling contact lists, and keep a clear record of where each record came from. Administrative fines were raised to 2,663 dollars per violation, or 7,988 dollars for intentional violations, from 2025 [4]. This is general information, not legal advice; the thresholds change, so check the current figures.

Sources
  1. California Consumer Privacy Act (CCPA) — State of California Department of Justice, Office of the Attorney General
  2. CCPA Regulations — State of California Department of Justice, Office of the Attorney General
  3. California Civil Code 1798.140 — Definitions — California Legislative Information
  4. Updated Monetary Thresholds in CCPA — California Privacy Protection Agency
External sources open in a new tab.

Related terms

Personal Data

If information can be linked to a specific person, it is personal data, and a work email like jane.doe@company.com counts.

GDPR

GDPR requires a lawful basis, transparency, and respect for individual rights whenever you process personal data about people in the EU, including business contacts.

Right to Erasure

People can ask you to delete their data, and for direct marketing you usually have to comply, generally within one month.

Publicly Available Data

Public does not mean free to use: under GDPR, personal data you find in public still needs a lawful basis, transparency and respect for individual rights.

CAN-SPAM Act

CAN-SPAM lets you send commercial email in the US without prior consent, as long as you are honest about who you are, include an address, and honor opt-outs quickly.

Opt-Out

Every commercial email needs an easy way to say stop, and once someone does, you must stop emailing them within the legal deadline and keep them suppressed.

Mentioned in
CASLData Minimization

Outreach without the busywork.

PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.

Start free with 100 credits →