[GTM glossary](/glossary.txt) CCPA

Data & Enrichment

# CCPA (CCPA)

Also known as: California Consumer Privacy Act

In short

The California Consumer Privacy Act (CCPA) is a California state law that gives residents rights over the personal information businesses collect about them. It was later amended and expanded by the California Privacy Rights Act (CPRA).

For GTM teams it matters because prospect and customer data, including business contact details, can count as personal information. This page is general information, not legal advice. Ask your counsel how the law applies to you.

## Rights it gives California residents

* **Know:** Ask what personal information a business collects and how it is used.
* **Delete:** Request deletion of personal information, with some exceptions.
* **Correct:** Ask for inaccurate information to be fixed.
* **Opt out:** Opt out of the sale or sharing of personal information.
* **Non-discrimination:** Exercising rights should not lead to worse treatment.

---

## Who it applies to

The law applies to for-profit businesses that do business in California and meet certain thresholds, such as revenue or the volume of personal information handled. Thresholds change, so check current rules or ask counsel rather than assuming you are exempt.

---

## What it means for sales and marketing

* **Know your data sources:** Track where contact data comes from, including purchased and enriched data.
* **Honor requests:** Have a process for access, deletion, and opt-out requests, and apply them across your CRM and outreach tools.
* **Keep suppression lists:** Store opted-out contacts so they are not re-added later.
* **Update your notice:** Your privacy policy should describe what you collect and why.

---

## CCPA vs. GDPR

Both give people rights over personal data. GDPR is a European Union regulation that generally requires a legal basis such as consent or legitimate interest before processing. The CCPA focuses more on notice and opt-out rights. They are different laws, and complying with one does not mean complying with the other.

---

## Common mistakes

* **Assuming B2B data is exempt:** Business contact details can still be personal information.
* **No request workflow:** Requests spread across tools get missed.
* **Ignoring vendors:** Your data providers and tools are part of your compliance picture.

---

## CCPA FAQs

**What is the CCPA?**

The CCPA is the California Consumer Privacy Act, a state law that gives California residents rights over their personal information, including the right to know, delete, correct, and opt out of its sale or sharing. This is general information, not legal advice.

**Does the CCPA apply to B2B sales and marketing data?**

It can. Business contact details such as names, work emails, and job titles may count as personal information. Whether the law applies to your company depends on its thresholds and facts, so confirm with legal counsel.

**What is the difference between CCPA and GDPR?**

GDPR is a European Union regulation that generally requires a legal basis before processing personal data. The CCPA is a California law centered on notice and rights such as access, deletion, and opt-out. Meeting one does not guarantee meeting the other.

**What should a sales team do to follow CCPA?**

Know where contact data comes from, honor access, deletion, and opt-out requests across every tool, keep a suppression list, and keep your privacy notice current. Check details with legal counsel, since this is not legal advice.

Share term

---

## More related phrases

* [GDPR compliance](/glossary/gdpr-compliance.txt)
* [CAN-SPAM](/glossary/can-spam.txt)
* [Data licensing](/glossary/data-licensing.txt)

## Similar phrases

* [Data privacy](/glossary/data-privacy.txt)  
Data privacy is the set of rules and practices that govern how personal information is collected, used, stored, and shared, so people keep control over their data.
* [Do not contact list](/glossary/do-not-contact-list.txt)  
A do not contact list records the people, domains, and companies your team must not message or call, so outreach respects opt-outs, legal limits, and business rules.
* [Opt-out](/glossary/opt-out.txt)  
An opt-out is a person's request to stop receiving marketing or sales messages, or to stop having their data used, and teams must record and honor it across every system.
* [Data security](/glossary/data-security.txt)  
Data security is the set of technical and organizational controls that protect data from unauthorized access, loss, or alteration, including encryption, access control, and monitoring.
* [Suppression list](/glossary/suppression-list.txt)  
A suppression list holds the contacts and accounts you must not email or advertise to, such as opt-outs, customers, and bounces, and is checked before every send.