CCPA and CPRA

How the CCPA and CPRA apply to B2B data

The law protects consumers, a word with a wider meaning here than in everyday use. A consumer is a person who resides in California, including employees, job applicants and contacts for business customers, vendors or independent contractors 2. A finance director in San Diego who appears on a prospect list is a consumer for this purpose.

For a few years, B2B data had a partial exemption. The exemptions for employment data and for personal information reflecting business-to-business transactions, in Civil Code Sec. 1798.145(m) and (n), expired on December 31, 2022 1. Since then, B2B contact data about California residents is covered like any other personal information.

Personal information is information that identifies, relates to or could reasonably be linked with a person or household 1. Names, email addresses and inferences used to build a profile of someone's preferences all count 1. Publicly available information is excluded, which includes government records and information a business reasonably believes the person lawfully made available to the general public 1.

Thresholds decide who must comply. The law applies to for-profit businesses that do business in California, decide why and how the information is processed and meet any one of three tests 2.

• Gross annual revenue at or above the threshold the agency publishes, last updated effective January 1, 2025 2.
• Buying, selling or sharing the personal information of 100,000 or more California residents or households 2.
• Deriving 50% or more of annual revenue from selling or sharing California residents' personal information 2.

The CPRA added more than rights. Voters approved it as Proposition 24 in November 2020, and it created the California Privacy Protection Agency 12. The agency implements and enforces the law, adopts regulations and can audit businesses 2. Its regulations on automated decision-making technology, risk assessments and cybersecurity audits took effect on January 1, 2026, with some deadlines phased in from 2027 2.

This page explains how the law is structured for data teams. It is not legal advice.

What a B2B data team has to handle

A prospect has the same rights as a shopper. Six operational pieces cover the core work.

**Know where California contacts live.** Tag records by state where the data allows it. Without that, every request has to be checked across the whole stack, from the CRM to every data enrichment export.

**Answer requests to know.** A person can ask for the categories and specific pieces of personal information collected, the categories of sources, the purposes and the categories of third parties involved, up to twice a year and free of charge 1. Source records matter here, since the answer has to name where the data came from.

**Delete and pass it on.** A deletion request covers the business and its service providers, which the business has to tell to delete as well, subject to exceptions 1.

**Handle opt-outs fast.** Businesses that sell or share personal information must offer a Do Not Sell or Share My Personal Information link and honor global privacy control signals 1. They have up to 15 business days to act on an opt-out 1. Sharing here means sharing for cross-context behavioral advertising 1.

**Keep a suppression record.** A deleted contact can come back through the next import or B2B data provider refresh. A minimal record of the identifier, checked before every load, stops that. RichAPI keeps the same kind of minimal record to suppress removed identifiers on future lookups 3.

**Check data broker status.** A business that knowingly collects and sells to third parties the personal information of people it has no direct relationship with is a data broker 2. Data brokers must register, and missing the January 31 deadline can bring daily civil penalties 2.

Treat these as standing processes with owners. A request that arrives during a campaign still has to be answered on time, and the same contact may sit in several tools at once.

Example of a California deletion request in a B2B stack

A sales team based in Texas runs outbound into California. A prospect replies to a sequence asking the company to delete her data and stop selling or sharing it. The ops lead runs a fixed playbook.

Step 1   Log the request and the identifier (work email)
Step 2   Add the identifier to the suppression list
Step 3   Stop any sale or sharing tied to the record
Step 4   Delete from CRM, sequencer and enrichment exports
Step 5   Tell service providers to delete as well
Step 6   Ask upstream data vendors to remove the record
Step 7   Confirm completion to the requester

Suppression and the stop on sale or sharing come first, because a business has up to 15 business days to act on an opt-out request 1. The suppression list stops the record from being re-imported while the deletion runs.

Step 5 follows the deletion right, which covers the business and the service providers it has to notify 1. Asking upstream vendors to remove the record is a practical addition, since a vendor refresh is a common way for a deleted contact to return.

For an API vendor such as RichAPI, the request goes to its privacy contact with the profile URL, email address or other identifier 3. RichAPI honors removal requests, propagates them to caches and keeps a minimal record of the identifier so it can suppress it on future lookups 3. It states that it does not operate a public people directory and does not sell or republish bulk datasets 3.

The team records the date of each step. If the same person later asks what data the company holds, the answer is short and documented, and the website visitor identification tool is checked too, since it can attach new activity to a known contact.