What do CCPA and CPRA require of California subscriber journeys?

What to take away

What CCPA and CPRA change for California email consent

The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) set the rules for how California businesses collect, use and share personal information, including email addresses. An email address is not just a delivery mechanism. It is personal information tied to a consumer who has rights.

The CCPA took effect in 2020. The CPRA amended it, added sensitive personal information as a category, and created the California Privacy Protection Agency. The Attorney General's office explains the obligations on its CCPA overview page.

Email consent requirements here are not the same as CAN-SPAM consent. CAN-SPAM is a federal law enforced by the Federal Trade Commission, and it sets rules for commercial email. The CCPA and CPRA add state privacy rights on top. A marketer can be CAN-SPAM compliant and still fail California privacy requirements.

Consent must be informed. If you collect an address for a newsletter, say what you will do with it. If you later want to use it for a different purpose, such as lookalike audiences or partner sharing, you need a lawful basis. Sharing for cross-context behavioral advertising is a form of sharing consumers can opt out of.

Consent must also be documented. You need to show what the consumer agreed to, when, and through what interface. That record is your defense if the Attorney General's office asks questions.

The statutory text is on the California Legislative Information site, and it defines terms like sell, share and sensitive personal information.

A pre-checked box is not consent. Under the CPRA, sharing rules require easy opt-outs, and bundled consent for email plus data sharing may not meet the standard.

Email addresses alone are not sensitive, but combined with geolocation or health data the rules tighten. Journey triggers that fire on sensitive data need extra care.

Separate consent purposes on the form. One checkbox for the newsletter, another for partner sharing, another for cross-context behavioral advertising. That structure makes opt-outs easier to honor later, and it aligns with the casl email subscriber journey rules that govern consent across borders.

The notice at collection

The CCPA requires a notice at collection stating the categories of personal information collected and the purposes. If you collect email addresses at checkout or signup, the notice must be there. A footer link is not enough when the collection point is a form.

The notice must also say whether you sell or share personal information. If a third-party ad platform receives addresses or hashed versions, that may count as sharing. Disclose it.

Consent for minors

The CPRA adds rules for consumers under 16. If you knowingly collect email addresses from minors, you need opt-in consent for sale or sharing. For those under 13, parental consent is required. Check the age gate on any journey aimed at a young audience.

The role of service providers

Your email service provider is likely a service provider under the CCPA, processing personal information on your behalf under a contract. The contract must limit the provider's use of the data. If the provider uses your list for its own purposes, it may be a third party, and sharing rules apply.

Subscriber data rights: access, deletion and opt-out of sale or sharing

California subscribers have four core rights that affect email programs: to know, to delete, to correct, and to opt out of sale or sharing. The Attorney General's privacy and data security page summarizes these rights and the obligations that come with them.

The right to know means a subscriber can ask what personal information you hold. For email marketers that includes the address, engagement history, inferred preferences and segment membership. You must compile it and deliver it in a portable format.

The right to delete covers the address and associated profile data. You must also direct service providers to delete. Exceptions exist for completing transactions or detecting security incidents, but routine marketing data is not exempt.

The right to correct lets a subscriber fix inaccurate personal information. If a journey trigger relies on a birth year or a stated preference, an error sends the wrong message. The correction right gives them a way to fix it.

The right to opt out of sale or sharing most affects email journeys. If you share addresses or hashed identifiers with ad platforms, subscribers can opt out, and you must honor it with a clear mechanism. The CPRA also requires you to honor opt-out preference signals such as the Global Privacy Control.

A subscriber who opts out of sharing can still receive email. The opt-out concerns sharing, not the email relationship. But any trigger that would send data to a third party must be suppressed.

Deletion requests can conflict with suppression lists. If a subscriber asks for deletion but you need the address to honor an opt-out, keep a minimal suppression record. It should contain only what prevents future contact. Document that decision.

Access requests reveal problems in your data model. If you cannot produce a subscriber's profile quickly, your data is scattered. A unified customer profile makes access and deletion easier and supports cleaner subscriber journey stages.

Verifying requests

You must verify that a request comes from the subscriber. A confirmation email to the address on file is a common method for email programs. Do not require an account the subscriber does not have, and do not collect more data than necessary.

Timelines

Businesses must respond to requests within 45 days, with a possible 45-day extension. That applies to access and deletion. If you expect volume, build the workflow now.

Authorized agents

A subscriber can use an authorized agent. You can require proof of authorization, but you cannot require the subscriber to verify directly if the agent holds power of attorney. Know the rules before you deny a request.

Journey triggers that depend on California subscriber data

Journey triggers start, stop or branch an email sequence. In California they can create privacy obligations, because the trigger may collect or use personal information that carries CCPA and CPRA rights. Those journey trigger implications extend to every vendor that receives data.

A welcome trigger fires when someone fills out a form. The data collected includes the address and any form fields. If the form captures partner-sharing consent, record it. If the subscriber later opts out of sharing, the series can run but the partner-sharing step must be removed.

A browse abandonment trigger fires when a subscriber views a product without buying. It often relies on cookies or pixels that track behavior across sites, which the CPRA treats as sharing for cross-context behavioral advertising. Suppress it for opted-out subscribers.

Knowing which data each trigger touches also answers the most common email journey platform pricing per contact questions, since the data a trigger uses often drives what you pay.

A re-engagement trigger fires after a period of inactivity and uses engagement data, which is personal information. If the subscriber requests deletion, that data must go. The trigger should not fire for a deleted subscriber.

A birthday trigger uses a birth date, which can be sensitive when combined with other data. The CPRA gives consumers the right to limit use of sensitive personal information. If the trigger also uses health data or precise geolocation, review it.

A post-purchase trigger uses transactional data, which is still personal information. The series can continue after an opt-out of sharing, but any data sent to a review platform for ad purposes needs a lawful basis.

Tag each trigger with the data it uses and the third parties it touches. That tag becomes part of your data map. When a subscriber exercises a right, you can see which triggers are affected. It also settles behavioral trigger email journey ideas about what data drives each segment.

Triggers and the Global Privacy Control

If your website receives the Global Privacy Control, treat it as a valid opt-out of sale or sharing. The signal should propagate to your email platform. Any trigger that would then share data with a third party should be suppressed. That needs a technical integration, not a policy.

Triggers and service providers

If a trigger sends data to a service provider, the contract must limit use. An email service provider that sends the message is one. An analytics platform that benchmarks the data for itself may be a third party, which affects whether you must offer an opt-out.

Triggers and inferred data

Triggers often use inferred data, such as a predicted product interest. Inferences are personal information under the CCPA, and subscribers have the right to know them. If a model predicts churn risk, that prediction is part of the profile and must be disclosable.

Enforcement posture of the California Attorney General's privacy unit

The California Attorney General's Privacy Enforcement and Policy Unit enforces the CCPA and CPRA, bringing actions against businesses that fail to honor consumer rights. The Attorney General's press releases page lists enforcement actions and settlements, and it shows what the office prioritizes.

Enforcement often starts with a consumer complaint or a sweep. The office has swept online businesses to check notice and opt-out compliance. If your signup flow lacks a notice at collection or an opt-out link, you are exposed.

The unit also focuses on the sale and sharing of personal information. Sharing addresses with ad platforms without an opt-out is a violation. The CPRA added sharing as a concept, and the Attorney General has said it applies to cross-context behavioral advertising.

The Attorney General's consumer protection page describes how the office protects consumers, including privacy rights. Enforcement is not abstract. Consumers can complain, and the office can act.

Penalties can be significant. The CCPA allows civil penalties, and the CPRA raised some amounts. A cure period exists for some violations but is not automatic, and the office can proceed without one in certain cases.

The unit coordinates with the California Privacy Protection Agency, which has rulemaking and enforcement authority and its own enforcement division. There are two enforcers, not one.

Settlements often require operational changes: revised consent flows, data deletion, a compliance monitor. The cost is not only the fine.

Recent attention has gone to loyalty programs and financial incentives. A discount in exchange for an email address may be a financial incentive. The CPRA requires a notice of financial incentive and a way to withdraw.

Dark patterns are another focus. If opting out is harder than opting in, that can be a violation. In email terms, the unsubscribe link should be as easy to find as the signup form.

Children's privacy also draws scrutiny. If a journey targets minors, opt-in requirements are strict, and the Attorney General can act under the CCPA and other laws. Verify the age of your audience when in doubt.

The role of the California Privacy Protection Agency

The Agency is separate from the Attorney General but shares enforcement authority. Its regulations fill in details on opt-out preference signals, dark patterns and risk assessments, all of which touch email consent and journey design. Watch its rulemaking alongside the Attorney General's actions.

What triggers an investigation

Complaints, media reports and sweeps are common triggers. A data breach can invite scrutiny too. If a breach involves email addresses and passwords, you may need to notify the Attorney General, and the office publishes breach notifications on its website.

Statutory text versus practical journey design

The statutory text is the foundation, but it does not tell you how to build a journey. You translate the law into design choices, and that translation is where most compliance failures happen.

The statute gives consumers the right to opt out of sale or sharing. In practice your email platform must suppress any trigger that shares data. If it cannot, use a tag or segment that excludes opted-out subscribers.

The statute requires a notice at collection. In practice the notice belongs at the point where you collect the address, conspicuous and easy to read. A landing page form needs it more than the footer does.

The statute requires you to honor deletion requests. In practice that means deleting from your email platform, CRM, analytics tool and any other system, and directing service providers to do the same. That is an operational task, not a legal one.

The statute requires consent before selling or sharing data of minors. In practice that means age gating and a way to verify parental consent.

The statute bars discrimination against consumers who exercise rights. You cannot deny a discount because someone opted out of sharing. A discount for joining the list is likely fine. A discount for allowing sharing is a financial incentive and needs a notice.

Bundling consent purposes is one of the costliest common email marketing strategy questions that teams get wrong.

Map each trigger to the requirement it touches. A welcome email touches notice at collection. A trigger that sends data to an ad platform touches opt-out of sharing. A birth date touches sensitive data limits. The map helps you prioritize.

Opt-out and unsubscribe differ. An unsubscribe stops email. An opt-out of sharing stops data sharing but may not stop email. Your preference center should say so, because a subscriber may want the newsletter without the sharing.

Your preference center should also let subscribers exercise access and deletion rights. A form is fine, as long as it is easy to find. Do not require a phone call when you offer email.

The role of consent records

Consent records are your evidence: date, time, IP address, the exact language the subscriber agreed to, and the method of consent. If you change the language, keep the old version. You must show what the subscriber saw.

The role of data maps

A data map shows what personal information you collect, where it goes and who receives it. It is not required by statute, but without one you cannot answer an access request or honor a deletion. Build one for the email program.

The role of vendor contracts

Contracts with email service providers, analytics platforms and ad partners should include CCPA and CPRA terms. They should limit the vendor's use of personal information and require help with consumer requests. A silent contract can leave you liable.

Documenting CPRA compliance inside lifecycle marketing

Documentation turns a policy into a defensible program. For lifecycle marketing that means records of consent, data flows, requests and decisions. The Attorney General can ask for them, and you should be able to produce them.

Start with a consent log. Record the source, date, language and IP address every time a subscriber opts in, and record sharing opt-outs too. The log should be immutable. If you use a consent management platform, connect it to your email platform.

Next, create a data map. List the data you collect: address, name, engagement history, inferred interests. For each, note the purpose, the legal basis, the systems that store it and the third parties that receive it. Update it when you add a trigger.

Then document the request process: how you verify access and deletion requests, how you respond, and how you train staff. If authorized agents are involved, record the verification steps. Keep a log of requests and responses.

You also need a retention schedule. The CCPA sets no specific period, but the CPRA requires you to disclose yours. If you keep data indefinitely, say so. If you delete after inactivity, document it.

Training is part of documentation. Marketing staff should recognize a consumer request and route it, and should not delete data on their own. An audit trail shows good faith, so review journeys periodically and document fixes.

If you use third-party tools, check their privacy documentation. The email journey mapping tools you pick should support consent tracking and data deletion. A tool that cannot delete a subscriber's data may not suit California.

The checklist below covers core documentation tasks for CPRA compliance in lifecycle marketing.

That is not exhaustive, but it covers the basics. Treat documentation as part of the campaign, not an afterthought.

Table: CCPA and CPRA requirements mapped to subscriber journey actions

Worked example: a California subscriber opts out

Suppose a subscriber named Alex joins your list and later opts out of sharing through the Global Privacy Control. Your email platform receives the signal and tags Alex as opted out. Journey triggers check that tag before sending data to any third party. The welcome series continues, but the step that syncs Alex to an ad audience is skipped.

Alex still receives email, and no data is shared. You log the opt-out and the suppression. If Alex later requests deletion, delete the email data and keep a suppression record containing only the address and the opt-out status.

Common pitfalls

One pitfall is assuming your email service provider handles compliance. The provider is a service provider; you are the business, and the obligation is yours. Another is treating an opt-out of sharing as an unsubscribe. A third is forgetting to update your privacy policy when you add a trigger.

Working with legal counsel

This is not legal advice, and California privacy law keeps changing. Work with counsel who knows the CCPA and CPRA. They can review consent flows, contracts and documentation, and help you answer a request or an inquiry from the Attorney General.

Common questions