CCPA Email Marketing: What California Privacy Law Means for Your Lists in 2026

CCPA email marketing means giving California residents notice at collection, an opt-out from the sale or sharing of their data, the right to access and delete what you hold, and a response process that closes within 45 days. Email addresses are personal information under the law. You only fall in scope if your business crosses one of three thresholds.

This article is educational. It is not legal advice. CCPA compliance depends on your specific business, revenue, data flows, and consumer base; a qualified privacy lawyer is the right person to sign off on your program.

What the CCPA is, and who it binds

The California Consumer Privacy Act took effect in January 2020 as California's omnibus consumer privacy law. The California Privacy Rights Act amended and strengthened it in January 2023, adding a right to correct, creating a "sensitive personal information" category with extra protections, and standing up the California Privacy Protection Agency as a dedicated regulator alongside the state Attorney General. Most operators still say CCPA when they mean the combined regime.

Obligations attach only if your business meets at least one of three thresholds:

1. Annual gross revenue over $25 million.
2. Buys, sells, or shares the personal information of 100,000 or more California consumers or households each year.
3. Derives 50% or more of annual revenue from selling or sharing California consumers' personal information.

Miss all three and you are technically out of scope. The catch is that the second threshold is lower than it sounds. California holds roughly 12% of the US population, so a moderately large US-focused list crosses 100,000 California addresses well before most operators think to check; at that point revenue is irrelevant and you are in scope on volume alone.

Building to the California bar is a defensive move even when you are out of scope. A growing number of US states have passed comprehensive privacy laws modeled closely enough on this one that the architecture transfers. Design for many states rather than for California, and the next law costs you a config change instead of a project. The official CCPA consumer guide from the California AG is a readable primer on the consumer-facing side.

One nuance that catches email teams out: the CCPA is much broader than email. A deletion request arrives against your whole stack, not just your ESP.

Personal information, and the rights attached to it

The statutory definition is sweeping. Per the CCPA statute, personal information is anything that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

Named categories include identifiers (name, email, account ID, IP address), commercial information such as purchase history, internet activity, geolocation, and inferences drawn from any of it. Email addresses are squarely in scope, and so are the open and click events your ESP logs against them.

The CPRA added sensitive personal information as a tighter sub-category: government IDs, financial account numbers, precise geolocation, racial or ethnic origin, religious beliefs, union membership, the contents of communications, genetic and biometric data, health data, and data revealing sexual orientation. Most email marketers never collect any of this deliberately. If you segment your list by health condition or religious affiliation, you are touching it whether you meant to or not.

Six rights matter for email marketing. The right to know (Civ. Code § 1798.110) lets a consumer request the categories and specific pieces of personal information you hold, the sources, the purposes, and the third parties you shared it with. The right to delete (§ 1798.105) covers information you collected from them, subject to nine enumerated exceptions. The right to correct (§ 1798.106) covers inaccurate data. The right to opt out of sale or sharing (§ 1798.120) lets a consumer stop both, with "sharing" added by the CPRA to capture cross-context behavioral advertising that businesses had been arguing was not a sale. The right to limit use of sensitive PI (§ 1798.121) restricts that category to the purposes the law allows. And the right to non-discrimination (§ 1798.125) means you cannot deny service, change the price, or degrade quality because someone exercised any of the others; loyalty programs and financial incentives survive, but only if they are structured carefully.

The response window is 45 days from receipt of a verifiable request, extendable once by another 45 when reasonably necessary. Note where the clock starts: at receipt, not at the point you finish verifying identity.

What "sale" and "sharing" mean in practice

This is where most email-marketer confusion lives. A sale is any disclosure of personal information to a third party for monetary or other valuable consideration. Sharing means disclosure for cross-context behavioral advertising even when no money moves.

Not a sale or share:

• Transferring data to a service provider bound by a written contract restricting use to your specified purposes, which covers your ESP, CRM, and analytics tool.
• Disclosures the consumer directs you to make.
• Disclosures necessary to complete a transaction the consumer initiated.

A sale or share:

• Renting your email list to a partner brand for their own marketing.
• Trading list data with another business.
• Letting a third-party ad network use email addresses as a join key for cross-site retargeting.
• Embedding tracking pixels from a third party that uses the data for its own purposes.

Send your own email to your own list through an ESP under a data processing agreement and you are doing neither. Participate in list rental, list exchange, or shared-subscriber targeting and you are; you now owe a "Do Not Sell or Share My Personal Information" link and a working process behind it. That fourth bullet is the one that surprises people, because nobody thinks of a pixel as a data transfer until a regulator characterizes it as one.

Notice at collection, and the request pipeline behind it

The CCPA requires notice at or before the point of collection. In practice the signup form, or the page hosting it, tells the visitor what categories of personal information you collect and why. Detail can live in the privacy policy, but the form has to make the link visible rather than burying it in a footer.

Patterns that hold up under audit: the form links to the privacy policy in the field area; the policy explicitly identifies categories collected and purposes for each; a "Do Not Sell or Share My Personal Information" link appears on the home page and footer if you sell or share; and the policy describes California-resident rights and how to exercise them. If you use double opt-in, the confirmation step is also a good place to restate what the opt-in actually covers.

The CPRA also created the Global Privacy Control signal. A GPC signal from a visitor's browser is a valid opt-out from sale or sharing, applied to both the device and the linked account. If your stack respects GPC at the browser level this is mostly automatic; if not, you need a manual workflow, and regulators have already shown they will treat the gap as a violation.

Three request flows are worth designing properly.

Access requests need a complete export of every category you hold, including what your ESP has logged (opens, clicks, bounces, suppression status) and anything in another system tied to the same identifier. Portable, machine-readable format, so CSV or JSON. Mailneo's per-subscriber export handles the email side; your CRM and analytics tools have to do the same.

Delete requests are harder because of propagation. Actually delete rather than merely suppress, remove the data from backups within a reasonable window (the CPPA has accepted the next routine backup rotation as reasonable), and instruct your service providers to delete as well. Note the interaction with your suppression list: deleting a contact outright can let them re-enter your list from a later import, so most teams keep a hashed suppression record and document why. The nine exceptions are real but narrow, and over-relying on them is a bad look in an enforcement letter.

Correct requests turn on verification rather than deletion. Confirm identity, confirm the correct value, update the record, propagate to service providers.

Verification deserves its own note, since it is where fraudulent requests get caught. The standard scales with sensitivity: a request to know categories needs less than a request to delete an account, and the CPPA has published regulations setting out acceptable methods. Verify before you act, and log what you checked.

Architecturally, most of this resolves to one privacy request inbox or form, a ticketing workflow with a 45-day SLA, and a runbook naming every system that holds consumer data plus the steps to extract or delete from each.

CCPA and GDPR side by side

US operators who already built for GDPR usually find CCPA additive but lighter; Europeans landing in California find the inverse.

Running a single global stack? Build to GDPR. The remaining California gaps are the notice text, the "Do Not Sell or Share" link, and GPC handling. Our GDPR email marketing guide covers the European baseline, and the GDPR glossary entry has the short version.

Neither law displaces CAN-SPAM, which is a common misreading. A commercial email to a California resident has to satisfy CAN-SPAM on sender identification, unsubscribe, and physical address, and satisfy the CCPA on notice at collection and consumer requests. They regulate different aspects of the same send; our CAN-SPAM compliance guide covers the federal half.

What enforcement targets

Under the original statute, enforcement sat with the California AG. The CPRA gave the CPPA co-enforcement authority and dedicated staff, which has accelerated case volume.

Three cases are worth knowing. Sephora was fined $1.2 million by the AG in 2022 for failing to disclose sale of personal information and failing to honor GPC signals, with the settlement naming the tracking pixels as the basis of the sale finding (CA AG press release). DoorDash settled for $375,000 in 2024 over cross-marketing arrangements with a marketing cooperative that the AG argued met the definition of a sale. And the CPPA's enforcement advisory on dark patterns warned that a confusing opt-out flow is itself a violation, independent of any underlying data sharing.

The pattern is consistent: regulators care much less about your privacy policy text than about whether your stack honors requests. A clean policy with a broken delete pipeline is a worse position than a plain policy with a working one.

A short operating checklist that has survived several customer audits:

1. Review annually whether you meet one of the three thresholds.
2. Notice at collection on every signup form, linked to a complete privacy policy.
3. Privacy policy lists categories of PI collected and the purpose of each.
4. "Do Not Sell or Share My Personal Information" link in the footer, if either applies to you.
5. GPC honored at both device and account level.
6. Privacy request inbox monitored, with the 45-day SLA tracked rather than assumed.
7. Access export covers the ESP, CRM, analytics, and every third party holding a copy.
8. Delete pipeline removes the record everywhere and instructs service providers to do the same.
9. Data processing agreement in place with every service provider.

Most of this is list hygiene work with a legal deadline attached, which is why the teams that already run clean lists tend to pass audits with the least drama. Mailneo's own CCPA tooling and policies cover what the platform handles for you.