CCPA and Email Marketing: What You Need to Know About California Privacy
If your email list includes California residents (and if you market anywhere in the United States, it almost certainly does), the California Consumer Privacy Act affects how you handle their data. CCPA doesn't ban email marketing. It doesn't require opt-in consent before sending. But it gives consumers rights over their personal information, including their email address, that go well beyond what CAN-SPAM requires.
The law has been in effect since 2020 and was strengthened in 2023 by the California Privacy Rights Act (CPRA). Yet many email marketers still don't understand what CCPA requires of them, how it differs from CAN-SPAM and GDPR, or what to do when a consumer exercises their rights. This guide covers the practical impact on your email marketing program.
Who Does CCPA Apply To?
Does CCPA apply to my business?
CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of these thresholds: annual gross revenue exceeding $25 million, buying/selling/sharing the personal information of 100,000 or more California consumers or households per year, or deriving 50% or more of annual revenue from selling or sharing personal information. If you meet any one of these criteria, CCPA applies regardless of where your business is physically located.
The revenue threshold catches more businesses than you might expect. And the 100,000-consumer threshold is about the number of people whose data you process, not the size of your email list. If your website collects cookies or analytics data from 100,000+ California visitors annually, you likely meet this threshold even if your email list is much smaller.
Consumer Rights That Affect Email Marketing
CCPA grants California consumers several rights over their personal data. Here's how each one affects your email marketing operations:
Right to know. Consumers can ask what personal information you've collected about them, where it came from, what you use it for, and who you've shared it with. For email marketers, this means being prepared to report: the consumer's email address and any associated data (name, purchase history, engagement data, segmentation tags), the source of the data (signup form, purchase, partner import), and any third parties you've shared the data with (your ESP, analytics tools, advertising platforms).
Right to delete. Consumers can request that you delete their personal information. You must honor this request within 45 days. For email marketers, this raises a tricky conflict with suppression lists (covered in detail below).
Right to opt out of sale or sharing. If you sell or share consumer data with third parties (including for targeted advertising), consumers can tell you to stop. This is triggered by the "Do Not Sell or Share My Personal Information" link that CCPA requires on your website. Note that "sharing" was added by CPRA and includes sharing data for cross-context behavioral advertising, which catches many common marketing practices.
Right to non-discrimination. You can't penalize consumers for exercising their rights. That means you can't charge higher prices, provide inferior service, or remove them from loyalty programs just because they opted out of data sharing or requested deletion.
CCPA vs CAN-SPAM: Where They Overlap and Diverge
Most US email marketers already comply with CAN-SPAM. Here's where CCPA goes further:
| Requirement | CAN-SPAM | CCPA |
|---|---|---|
| Consent model | Opt-out (can email until they unsubscribe) | No separate email consent, but opt-out of data sale/sharing |
| Unsubscribe | Must honor within 10 business days | Not directly addressed (covered by CAN-SPAM) |
| Data deletion | Not required | Must delete within 45 days upon request |
| Data access | Not required | Must provide upon request within 45 days |
| Data sale/sharing | Not addressed | Must allow opt-out; "Do Not Sell" link required |
| Applies to | All US commercial email | Businesses meeting thresholds with CA consumers |
| Enforcement | FTC | California AG + CA Privacy Protection Agency; private right of action for data breaches |
The key difference: CAN-SPAM controls what you send. CCPA controls what you do with the data. You can be fully CAN-SPAM compliant (proper unsubscribe, physical address, accurate headers) while violating CCPA (failing to honor deletion requests, selling data without opt-out mechanisms, lacking a compliant privacy policy).
Handling Deletion Requests Without Breaking Your Suppression List
This is the trickiest CCPA compliance issue for email marketers. When a consumer requests deletion, you must remove their personal data. But CAN-SPAM requires you to maintain a suppression list of people who have unsubscribed so you don't accidentally email them again. If you delete the email address entirely, you lose the ability to suppress it.
The practical solution: CCPA allows you to retain the minimum data necessary for compliance with other legal obligations. CAN-SPAM's suppression requirement qualifies. So you can keep the email address on your suppression list after deleting all other associated data (name, purchase history, engagement data, segmentation information). Document this retention justification in your privacy policy.
The process should work like this:
- Receive a deletion request from a California consumer
- Verify the consumer's identity (CCPA requires reasonable verification)
- Delete all personal information associated with that email address from your marketing database, CRM, and any downstream systems
- Retain only the email address on your suppression list with a note that it's retained for CAN-SPAM compliance
- Confirm deletion to the consumer within 45 days
- Ensure the suppressed address doesn't re-enter your active database through future imports or signups
Privacy Policy Requirements for Email Marketers
CCPA requires your privacy policy to include specific disclosures. For email marketers, the relevant requirements include:
- Categories of personal information collected. List the types of data you gather from email subscribers: email addresses, names, engagement data, purchase history, device and IP information from email opens/clicks.
- Purposes of collection. Explain why you collect each category: sending marketing communications, personalizing content, analytics, transactional communications.
- Third-party sharing. Disclose which categories of data you share with third parties and who those parties are (your ESP, analytics tools, advertising platforms).
- Consumer rights. Explain how consumers can exercise their rights to know, delete, and opt out, including contact methods and expected response times.
- "Do Not Sell or Share" link. If you sell or share data (including for behavioral advertising), include a conspicuous link on your website.
Update your privacy policy at least annually, and review it whenever you change ESPs, add new marketing tools, or modify your data sharing practices.
How Email Verification Supports CCPA Compliance
Email verification doesn't directly satisfy CCPA requirements, but it supports several compliance best practices:
Data minimization. CCPA encourages collecting only the data you need. By verifying email addresses at the point of collection using the real-time API, you ensure you're only storing valid, functional addresses. Invalid addresses are data you don't need and shouldn't retain.
Accurate record-keeping. When a consumer exercises their right to know, you need to provide accurate information about what you've collected. A clean, verified database makes this process straightforward. A messy database with duplicates, outdated records, and invalid addresses complicates every access request.
Efficient deletion processing. Deletion requests require you to locate and remove all instances of a consumer's data. A clean database with verified, deduplicated records makes this process faster and more reliable than searching through a database full of duplicates and variations. Run your list through bulk verification regularly to keep your database clean and deletion-ready.
Reduced data breach risk. CCPA provides a private right of action for data breaches involving unencrypted personal information. The less invalid and unnecessary data you store, the smaller your exposure in a breach. Verification helps you maintain a lean database of only the records you actually need.
Frequently Asked Questions
Does CCPA require opt-in consent before sending marketing emails?
No. CCPA does not change the consent model for email marketing. The US still operates under CAN-SPAM's opt-out framework, meaning you can send marketing email to someone who hasn't explicitly consented as long as you provide a clear unsubscribe mechanism. CCPA's consent requirements relate to data sale and sharing, not to email sending itself. This is a key difference from GDPR, which requires affirmative opt-in consent.
What if a customer exercises their CCPA deletion right but is still on my CAN-SPAM suppression list?
You can retain their email address on your suppression list because CAN-SPAM compliance is a legal obligation that justifies minimal data retention under CCPA. Delete all other associated data (profile information, purchase history, engagement metrics) but keep the email on the suppression list to prevent accidental re-subscription. Document this retention practice in your privacy policy.
Does sending email count as "selling" data under CCPA?
Sending email to your own list is not "selling" data. However, if you share subscriber data with third-party advertising platforms for targeted ads (including custom audiences on social media), that may qualify as "sharing" under the CPRA amendment. The distinction matters because sharing triggers the "Do Not Sell or Share" opt-out requirement.
How does CCPA interact with GDPR if I have subscribers in both California and the EU?
Apply the stricter standard to each population. For EU subscribers, apply GDPR (which requires opt-in consent). For California subscribers, apply CCPA (which requires deletion and access rights). Many businesses simplify compliance by applying GDPR standards globally, since GDPR's opt-in requirement is stricter than both CCPA and CAN-SPAM.
Do I need to verify the identity of someone making a CCPA request?
Yes. CCPA requires reasonable verification of the requestor's identity before processing access or deletion requests. For email marketing, this typically means confirming the request comes from the email address in question (by sending a confirmation email) or matching the request against existing account information. The verification standard should be proportional to the sensitivity of the data and the risk of unauthorized access.
Stay Compliant as Privacy Laws Expand
CCPA is just the beginning. More states are adopting similar privacy frameworks, and a federal privacy law remains possible. The businesses that invest in compliant data practices now will adapt more easily as the regulatory environment evolves.
Start with the basics: update your privacy policy, implement a process for handling deletion and access requests, and keep your email database clean with regular verification. A lean, accurate database is easier to manage for compliance and performs better for marketing. Both goals align perfectly.
Stop Bouncing. Start Converting.
Millions of emails verified daily. Industry-leading SMTP validation engine.