What is the CCPA (California Consumer Privacy Act)?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Say you sell software and someone in California signs up for your list. The CCPA (California Consumer Privacy Act, effective 2020) gives that person rights over their personal information: the right to know what you've collected, the right to delete it, and the right to opt out of its sale. Unlike GDPR or CASL, CCPA doesn't require consent to send email. It governs what you do with the data.
CCPA applies to for-profit businesses meeting any of these thresholds: annual gross revenue over $25 million; buying, receiving, or selling personal information of 100,000+ California residents or households; or deriving 50%+ of annual revenue from selling personal information. If you're running a meaningful email program as part of a commercial operation, you likely qualify.
Key rights your California subscribers have: right to know what personal information you've collected and how it's used; right to delete personal information on request; right to opt out of the sale or sharing of personal information; right to non-discrimination for exercising those rights. The CPRA (California Privacy Rights Act) strengthened these provisions further.
The practical impact on email programs: a deletion request under CCPA means actually deleting the data, not just suppressing the address. See how CCPA affects email marketing specifically for what that means for your list management, and check which other laws may apply simultaneously to your program.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
