CCPA Compliance for Cold Calling and Cold Email in 2026

CCPA compliance controls how you collect, store, and use contact data for cold calls and cold emails. It does not stop you from reaching out. It controls the data sitting behind that outreach.

Here is the problem. A prospect replies: delete my data. Your rep does not know who owns that request. The contact stays live in your CRM, your sequencer, and your ABM list. That is a real violation, not a small mistake. Fines run up to $7,988 per violation. Data brokers now face $200 a day for missed deletions.

This guide breaks down what CCPA requires for cold outreach. You get a clear checklist for sourcing lists, handling requests, and closing the gaps behind these fines.

What Is CCPA Compliance?

CCPA sits under two other laws. Each one covers something different, and each one carries its own fines.

What CAN-SPAM and TCPA Cover

CAN-SPAM governs the content of any cold email campaign: no misleading subject lines, a working unsubscribe link, real sender information. Break any of these and each email is a separate violation, worth up to $53,088. Verkada, a security camera company, paid $2.95 million to settle a CAN-SPAM case. Experian paid $650,000 for the same reason.

TCPA governs any cold calling program, including texts. It requires consent before an autodialed call or text, and it sets calling hours. Violations run $500 to $1,500 per call or text, with no cap. A new rule from January 2025 also ended a common lead-gen trick: one consumer consent can no longer cover multiple buyers. Each caller now needs its own consent on record.

Neither law touches how you got the contact in the first place. That question belongs to CCPA.

What CCPA Covers

CCPA covers the personal data behind the outreach: name, email, direct dial, job title, even a LinkedIn URL you scraped for personalization. Syncing that list to an ad platform, or handing leads to a partner, can also count as a sale or share under the law.

Here is the real difference from TCPA. TCPA needs consent before you act. CCPA rights mostly kick in after the fact: a consumer can ask you to know, correct, delete, or stop selling their data once you already have it. A clean subject line will not fix a bad data source, and a signed TCPA consent form will not answer a CCPA deletion request.

Does CCPA Apply to B2B Contacts?

This one has a history worth knowing. California first exempted B2B and employee data from CCPA in 2019, set to expire in 2021. Lawmakers extended it once, to 2022. The CPRA ballot measure extended it again, to 2023. Then the legislature let it lapse for good.

Since January 2023, a prospect's work email, direct dial, and job title count as personal data. Same category as a home address. Before that date, you could email a business contact with none of the CCPA rights attached. Not anymore.

Where Does Outreach Data Come From?

How to Check Your Data Source

Not all sourcing carries the same risk. Four tiers, roughly in order:

• Public professional data: bylines, staff pages, official directories. Lowest risk if collected transparently.
• First-party data: your own forms, events, and opt-ins. The gold standard, since you hold the consent record.
• Licensed or partner data: fine, if the vendor can prove a lawful basis and pass-through rights.
• Scraped social profiles: high risk. Plenty of platforms prohibit it, and regulators treat bulk scraping harshly.

Ask where last quarter's list sits on that scale. A scraped export or a list bought off a forum sits at the bottom. Even a solid-looking cold calling database needs this same check before you trust it.

Compliant B2B data starts with a known source. If your vendor cannot name it in one sentence, treat the list as a risk, not an asset.

What Is the Data Broker 45-Day Rule?

This part sits under a related law, not CCPA itself: California's Delete Act, enforced by the same regulator, the California Privacy Protection Agency. If your list vendor counts as a data broker (any business that knowingly collects and sells personal data of people it has no direct relationship with, no revenue threshold required), that vendor now has real deadlines.

Since August 2026, brokers must check a state deletion platform every 45 days and act on matching requests. Miss that window and fines run $200 per request, per day, with no grace period. If your vendor misses a deletion, that gap becomes your problem the moment a regulator asks who still holds the data.

What to do: Ask every list vendor two questions. Are you a registered data broker? How do deletion requests reach my CRM?

Evaluating a B2B data partner means asking this before you sign, not after a complaint lands.

How to Handle a CCPA Data Request

Replies come in plain language, not legal terms. Here is what they mean and how fast you have to move.

For know, correct, and delete requests, you also have to confirm receipt within 10 business days, ahead of the 45-day deadline. Silence for the first ten days is itself a problem, even if you meet the final deadline.

The gap is rarely the request itself. It is the sync between tools. A contact opts out in one system. Three others still show them as live and contactable. That gap causes more CCPA problems than any sourcing issue.

What Changed in CCPA for 2026?

Three updates touch a cold outreach program directly.

• Lead scoring can count as automated decision-making if it changes how you treat a prospect, such as auto-disqualifying them from a sequence. Consumers may get an opt-out right, and a human review has to understand the model, not rubber-stamp the score.
• Sharing your list with an ad platform or a co-marketing partner now needs a written risk check first, not after the fact.
• Data brokers must clear California's deletion list every 45 days, starting August 2026, under the Delete Act described above.

Ad-tech is the main target here. But a scored lead, a synced list, or a purchased contact pulls this straight into your outbound stack.

CCPA Compliance Checklist for Cold Outreach

Six checks worth running this quarter, not filing away in a compliance binder.

1. Source every list from a name you can state in one sentence: your own forms, your events, or a named vendor. Treat anything else as unapproved until someone checks it.
2. Never re-add a deleted or opted-out contact through your CRM data enrichment workflow, even under a different email.
3. Route every access, delete, or correct request to one designated queue. Reps should not improvise a reply or promise a timeline.
4. Keep sensitive notes, health details, and financial data out of call logs and CRM fields entirely. There is no legitimate reason for them to be there.
5. Confirm your GPC opt-out signals get checked across your full stack, not just your website form.
6. Treat bad CRM data as a compliance risk, not just a productivity problem. An unverified record is the one likely to surface in a request you cannot answer cleanly.

If your outreach also touches EU contacts, the rules shift again. Read GDPR and cold calling before you assume one policy covers both. And if your cold email software is not the tool enforcing suppression, that is the gap to close first.

How far back must outreach data go for a request?

If you kept a contact's data more than 12 months, California's 2026 rules may require records back to January 1, 2022.

See how SMARTe sources verified contact data for outbound teams, built under SOC 2 Type II, GDPR, and CCPA compliance from the start.

Teams that never end up defending a data source are the ones who could name it before anyone asked.