How does CCPA affect email marketing?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
CCPA doesn't regulate whether you can send email. What it does is give California residents rights over the data you hold on them. If someone asks what you've collected, you tell them. If they ask you to delete it, you delete it, not just suppress their address. Those are two different things, and confusing them is one of the most common compliance gaps in email programs.
If you sell or share personal information with advertising partners, including email addresses, CCPA requires a "Do Not Sell or Share My Personal Information" link. Under CCPA/CPRA, sharing data with ad networks for cross-context behavioral advertising can count as "selling" even when no money changes hands. This affects data practices common in email marketing: list sharing, co-registration, and retargeting audiences built from your subscriber data.
Privacy notices must disclose what categories of personal information you collect, why, and which third parties receive them. California residents can't be penalized (denied service or charged different prices) for exercising their CCPA rights.
If you're in scope for CCPA, check two things first: whether your unsubscribe flow handles actual deletion (not just suppression) of California subscriber data, and whether your privacy notice clearly covers your data-sharing practices.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
