Does the CCPA Apply to B2B Cold Email in California

Yes, it can. The CCPA applies to B2B cold email when two things are true together: your company is a business the law covers, and the person you are emailing is a California resident.

The exemption that kept business contact data out of most of the law expired on December 31, 2022, according to the California Attorney General. A buyer's work email and job title now count as personal information, the same as a home address.

The CCPA does not ban the email. It regulates the data behind it: where the address came from, what you tell people about it, and what you do when someone asks to see it, correct it, delete it or stop it being sold. The message itself answers to CAN-SPAM and to the inbox providers.

My team's outreach goes mostly to the USA, the UK and Europe, and any sizeable US list will include California buyers. California law sits on top of the federal and Gmail rules, it does not replace them. This is not legal advice. Check your setup with a California privacy lawyer.

What changed when the B2B exemption expired?

Until the end of 2022, personal information that reflected business-to-business transactions sat outside most of the CCPA. Both the Attorney General and the California Privacy Protection Agency state that this exemption, and the one for employment-related data, expired on December 31, 2022.

The agency's FAQ is direct about who it brings in. California residents include contacts for business customers, vendors and independent contractors.

Under the statute, a consumer is any individual who lives in California (Civil Code section 1798.140). The construction company you are selling to is not a consumer. Its head of procurement in Sacramento, reading your email, is.

So "can I email this person?" and "does privacy law cover the data I hold about them?" are separate questions with separate answers. Founders answer the first one and skip the second. That is the gap. A California send has four parts to check:

The short yes-no for the CCPA layers:

The message rules apply in all three rows.

When does the CCPA apply to you as the sender?

The statute covers a for-profit business that does business in California and meets at least one of three thresholds (section 1798.140):

1. More than $25 million in gross revenue in the preceding year, a figure the statute adjusts for inflation; the CPPA puts it at $26.625 million from January 1, 2025
2. It buys, sells, or shares personal data tied to at least 100,000 California consumers or households
3. At least half of its annual revenue comes from selling or sharing personal information

Most founders stop at the revenue line. The second one is easy to miss. The statute counts buying as well as selling and sharing, and only California records count toward the 100,000. Take a 30-person agency well under the revenue line. If it buys large California contact files, it can still end up inside. Take that to counsel before the next purchase.

The statute's examples of personal information include an email address and professional or employment-related information, once tied to a specific person. One CRM row with a name, a work email, "VP Finance" and "Irvine" is personal information about a California resident.

The statute also treats advertising and marketing as any message meant to get someone to buy goods or services or take a job. A cold email offering a call about your service fits that description.

The sender-side test, then, is three questions you can answer in an afternoon:

• Is your company for-profit and doing business in California?
• Does it meet any of the three thresholds?
• Does it hold personal information about California residents?

Three yeses mean the CCPA applies to your California contacts. Write the answer down with the date, because the second threshold can change with one list purchase.

What rights do B2B contacts have now?

The Attorney General lists the rights California residents hold against covered businesses. Since the exemption ended, a business contact holds them too. In outbound, each one shows up at a predictable moment:

Covered businesses also have duties that exist before anyone asks. The CPPA says they must tell consumers how they collect, use and retain personal information, give them methods to exercise their rights, and post a privacy policy with instructions for making requests. Where the opt-out right applies, the site needs a clear link such as "Do Not Sell or Share My Personal Information."

Each right has its own conditions, so not every request must be granted in full. The safe assumption: any California contact can ask, and you need a process that answers on time.

Keep unsubscribes and deletions apart in your process. An unsubscribe stops the emails. A deletion request reaches the CRM, the sequencer, the enrichment tool and any spreadsheet export. A deleted contact can also come straight back on the next list you buy. Ask counsel how to keep a minimal do-not-contact record so a deletion stays a deletion.

What should you check in your lead list vendor?

California keeps a public data broker registry, run by the CPPA. The agency says a data broker gathers consumer personal information from many sources and sells it onward. Any business that meets the definition must register every year between January 1 and 31, and the current registry lists businesses that operated as data brokers in 2025.

Since January 1, 2026, California residents can use a platform called DROP to send one deletion request to every active data broker. Brokers had to start processing those requests on August 1, 2026.

For the sender, one consequence matters. A deletion the broker processes in its own database does not clean the copy you exported three months ago. Re-pull data instead of mailing old exports, and note the export date on every list.

The decision rule: if your vendor sells contact data about people it has no relationship with to companies like yours, search its name in the registry before you buy. If it is listed, read two fields in its entry, "Data Collection Includes" and "Data Sold / Shared To." If it is not listed, ask why, in writing.

My team builds lists from established data providers such as Sales Navigator, Apollo and UpLead, and I rate them above scraped exports. I have seen cheap freelancer lists open poorly and bounce hard. A scraped file has a California problem on top of that: there is no vendor to ask, no registry entry to read, and nobody who will tell you where a record came from when a contact asks.

When a provider's sales page says "fully compliant," test that claim against how the data was actually sourced. If you would rather hand list building to someone else, see the cold email agency page. For California, ask these five questions before you sign:

1. Are you registered as a data broker in California, and under which business name?
2. Where does the contact data come from, in one sentence per source?
3. How do deletion requests you receive, including through DROP, reach customers who already exported the records?
4. When was each record last updated and verified?
5. Can I filter or flag contacts located in California?

If the answer to question 2 takes a paragraph, treat the data like a scraped file.

How do CAN-SPAM and Gmail rules fit on top of CCPA?

Two other sets of rules govern the email itself, and neither cares about the B2B label.

FTC guidance says business emails are not exempt. It covers every commercial message, meaning an email whose primary purpose is commercial advertisement or promotion. When a message mixes content, the primary purpose decides.

For a commercial email, the FTC guide requires:

• Header information that is accurate and not misleading
• A subject line that does not deceive
• Plain identification of the email as an advertisement
• Your valid physical postal address
• An easy opt-out from future marketing email
• Opt-out requests honored within 10 business days

The FTC says each violating email may lead to a fine of up to $53,088.

Gmail adds a deliverability layer. Google's sender requirements have applied since 2024 to anyone sending to Gmail personal accounts. Every sender needs SPF or DKIM and a TLS connection. Above 5,000 messages a day, Google also requires DMARC on top of SPF and DKIM. Those bulk senders must also give marketing messages one-click unsubscribe and an obvious unsubscribe link in the body.

In B2B, "Gmail personal accounts" mostly means consultants, freelancers and small-firm owners on a gmail.com address.

Break CAN-SPAM and the email is unlawful. Miss the Gmail rules and it lands in spam, where nobody reads it. On every sending domain, my team sets up SPF, DKIM and DMARC before a single campaign goes out, and a client's invoicing domain is never used for outreach. The details are in how we set up domains, inboxes and warm-up.

What is the safest way to send B2B cold email to California?

When a founder tells me nobody answers their cold emails, I ask for the list before I read the copy. Copy cannot fix a bad list or a weak sender. In California a bad list is a legal problem too. Most of the privacy work starts at the list.

One example from a single LinkedIn account, and it is not a California case: in 30 days, 1,200 contacted -> 289 replies -> 21 interested -> 16 booked -> 12 showed -> 3 closed. Every number in that chain started with who was on the list. Get the list right and the rest of the funnel has something to work with.

Run this before the first California send:

1. Sender test. Answer the three coverage questions and file the answer with a date.
2. Source per list. Name where each list came from in one sentence; drop scraped exports and cheap freelancer files. Here is how I take a lead list apart before anyone touches the copy.
3. Vendor status. Check the registry entry, or the written answer on why there is none.
4. Verification. We check each address with NeverBounce or DeBounce before it is used, with bounces held below 0.5%.
5. Privacy policy. It should say how you collect, use and keep prospect data and how a person makes a request.
6. Message basics. Sender identity, a plain note that it is a sales email, postal address and a working opt-out in every email.
7. One request queue. "Remove me," "delete my data" and "where did you get this" go to one owner, get answered, and get suppressed in every tool.
8. Records. Source and export date stored against every contact.

A UK social media marketing agency is a useful example of building from named providers, though California was not part of it. My team built lists for 3 niches from Sales Navigator, Apollo and UpLead, then ran LinkedIn outreach, warm emails and cold email, with no paid ads.

Calls booked through email and LinkedIn went 44 -> 57 -> 68 in months 1-3, and the total reached 714 sales calls in 12 months.

Borderline cases are the norm here. A conservative rule for each:

• Location unclear. If the profile or the company address puts the person in California, treat them as a California resident.
• Personal address used for work. A consultant's gmail.com address is still personal information, and Gmail's personal-account rules apply. Prefer the work address, or open on LinkedIn.
• Consumer-facing company. A California retailer's marketing director is a B2B contact like any other. What matters is the data you hold about her; the retailer's own customers are a separate matter for the retailer.
• Contact asks for deletion. Delete across every tool, keep only what counsel approves as a suppression record, and never re-import from the next list.
• Coverage still unclear. Run the full process anyway.

In our campaigns, we connect on LinkedIn before any email goes out, so the email arrives warm. The data you collect about that person is still covered the same way.

Here is an example first email, sent after a LinkedIn connection, that covers the basics. It is written to a VP of Operations at a California construction company (the sender, names and domain are made up):

Subject: Bid tracking for your estimating team

Hi Maria,

We build custom estimating and bid-tracking tools for general
contractors. Teams that still rebuild every bid in spreadsheets
know how repetitive it gets.

Would a 20-minute call next week be useful to see if a custom
tool would save your estimators time?

Alex Novak, Northline Software, full street address and ZIP
This is a sales email. Your work email came from our data
provider, Apollo. Reply "remove" and we will not email you
again, or ask us to delete your details and we will.
Privacy policy: northline.example/privacy

The source line is optional, but the Attorney General says a covered business must disclose its categories of sources on a request to know. The email answers that before anyone asks.

The list carries the risk, not the copy. Run the sender test, write down the date, and have a California privacy lawyer confirm it. Then fix the list before you touch a subject line.

Sending to California and not sure whether your list is the risk? Book a call and I will tell you how I would check it. I am not a lawyer.