Cold email laws
CCPA and CPRA: What They Mean for Cold Email
Yes. The CCPA is a privacy law, not an anti-spam law, so it sets no consent rule for email. Since January 1, 2023 it covers business contacts: a covered business must disclose its data practices, honor deletion and opt-out requests, and faces up to USD 7,988 per intentional violation.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under the CCPA?
In short Yes: the CCPA sets no consent rule for email (CAN-SPAM covers the message), but a covered business must disclose its data practices, honor deletion requests and let people opt out of sale or sharing, B2B contacts included since 2023.
The CCPA does not decide whether you may send a cold email; CAN-SPAM does. The CCPA governs how a covered business collects, uses, sells and shares a California resident's personal information, and a work email address counts. The exemption for business-to-business contacts in section 1798.145(n) became inoperative on January 1, 2023, so a business contact who lives in California is a consumer with full CCPA rights.
It binds only a business that meets one of three tests: annual gross revenue above USD 26,625,000 (the figure adjusted for inflation from January 1, 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning 50% or more of its revenue from selling or sharing personal information (section 1798.140(d)).
For a cold email program, the duties are notice and a privacy policy, purpose limits, the right to delete, the right to opt out of sale or sharing, and contracts with the vendors that handle the data. Prospects cannot sue over these duties: the private right of action covers only data breaches (section 1798.150).
What Do You Need to Do Under the CCPA?
In short 7 rules apply to a cold email program under the CCPA.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Check whether you are a covered business | The CCPA binds only for-profit businesses that meet one of three thresholds. | Compare your revenue with USD 26,625,000 and count the California contacts you buy, sell or share. | Civ. Code 1798.140(d)(1); CPPA monetary thresholds |
| Notice and privacy policy | When you collect personal information from the consumer, disclose at or before collection the categories, the purposes and whether you sell or share it. A business that does not collect directly from the consumer and neither sells nor shares the data does not need a notice at collection. | Keep a privacy policy that covers prospect data and CCPA rights, and give notice when you collect directly (forms, replies) or sell or share. | Civ. Code 1798.100(a); 11 CCR 7012(h) |
| Purpose limits | You may not use personal information for new purposes that are incompatible with the ones you disclosed, without new notice. | Use prospect data only for the outreach purposes you disclosed. | Civ. Code 1798.100(a)(1) |
| Right to delete | A consumer can ask you to delete personal information you collected from them. You must delete it, tell your service providers and contractors, and respond within 45 calendar days (up to 90 with notice). | Route delete-my-data replies to a privacy workflow, separate from unsubscribes, and purge the contact from your CRM and sending tools. | Civ. Code 1798.105 and 1798.130(a)(2); 11 CCR 7021(b) |
| Right to opt out of sale or sharing | Consumers can tell you not to sell or share their personal information, where sharing means disclosure for cross-context behavioral advertising. Stop within 15 business days. | If you sell lists, trade data or upload contacts to ad platforms, offer a Do Not Sell or Share option and honor it. | Civ. Code 1798.120; 11 CCR 7026(f)(1) |
| Contracts with vendors | Service providers and contractors must be bound by a written contract that limits how they use the data. | Put CCPA terms in contracts with data providers, enrichment tools, sending platforms and agencies. | Civ. Code 1798.140(j)(1) |
| Easy opt-outs | Do not ask for more information than you need to process an opt-out, and offer choices that are equally easy to make. | Process opt-out requests from the email address alone where you can. | CPPA, American Honda decision (2025) |
What Are the Penalties Under the CCPA?
In short Maximum penalty: USD 7,988 per intentional violation.
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| Fine per violation (CPPA or Attorney General) | USD 2,663 per violation, as adjusted for inflation from January 1, 2025 | USD 2,663 | Civ. Code 1798.155(a) and 1798.199.90(a) |
| Fine per intentional violation, or one involving consumers known to be under 16 | USD 7,988 per violation | USD 7,988 | Civ. Code 1798.155(a) and 1798.199.90(a) |
| Consumer lawsuit after a data breach caused by poor security (not cold email) | USD 799 per consumer per incident (at least USD 107), or actual damages if greater | USD 799 | Civ. Code 1798.150(a) |
The California Privacy Protection Agency brings administrative actions, and the Attorney General brings civil actions. Consumers can sue only over data breaches caused by poor security (section 1798.150), not over cold email practices.
What Enforcement Has There Been Under the CCPA?
In short 3 cases from regulator and court records, newest first.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2025-03-12 | American Honda Motor Co. | Asked for too much information to process opt-outs, offered unequal privacy choices and shared data with ad tech companies without the required contracts. | USD 632,500 from the CPPA | CPPA announcement |
| 2024-02-21 | DoorDash, Inc. | Gave customers' names, addresses and order histories to a marketing cooperative without notice or a chance to opt out. | USD 375,000 civil penalty (Attorney General) | Attorney General press release |
| 2022-08-24 | Sephora, Inc. | Did not tell consumers it was selling their personal information and ignored Global Privacy Control opt-out signals. | USD 1.2 million (Attorney General) | Attorney General press release |
Cold Email Checklist for the CCPA
- Check whether your company meets one of the three CCPA thresholds.
- Keep a privacy policy that covers prospect data and CCPA rights.
- Use prospect data only for the outreach purposes you disclosed.
- Route delete-my-data replies to a privacy workflow and answer within 45 calendar days.
- If you sell or share contact data, or upload it to ad platforms, offer an opt-out and honor it within 15 business days.
- Put CCPA terms in contracts with data providers, sending tools and agencies.
- Follow CAN-SPAM for the email itself: honest headers, postal address and a working opt-out.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under the CCPA, that includes your privacy policy and answering access and deletion requests.
FAQ
Does the CCPA apply to B2B contacts?
Yes. The business-to-business exemption in Civ. Code 1798.145(n) became inoperative on January 1, 2023. A business contact who lives in California is a consumer, even when you reach them at a work address.
Do I need consent to cold email Californians?
Not under the CCPA. It sets no opt-in or opt-out rule for sending email; its duties cover collecting, using, selling and sharing personal information. CAN-SPAM governs the email itself.
Do I need a notice at collection if I sourced the contact list?
Not if you did not collect the data directly from the consumer and you neither sell nor share it (11 CCR 7012(h)). A covered business still has to honor CCPA rights requests.
How fast must I answer a prospect's deletion request?
Within 45 calendar days of receiving it. You can extend to 90 days in total if you tell the consumer (11 CCR 7021(b); Civ. Code 1798.130(a)(2)).
What are the CCPA fines?
Up to USD 2,663 per violation, or USD 7,988 per intentional violation or one involving consumers known to be under 16. These are the amounts adjusted for inflation from January 1, 2025, and the CPPA or the Attorney General can impose them.
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- CAN-SPAM Act: What It Means for Cold Email
Allowed, opt-out
- GDPR: What It Means for Cold Email
Legitimate interest; consent rule varies by country
- PIPEDA: What It Means for Cold Email
Exempt if role-relevant; CASL still governs the email
- Ken anti-spam policy
Sources
Changelog
- Page published.