- The law
- California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act; California Civil Code section 1798.100 onwards
- Who enforces it
- California Privacy Protection Agency and the California Attorney General
- Penalties
- Up to $2,663 for each violation, or $7,988 if intentional or involving under-16s (amounts set by the CPPA from 1 January 2025)
What it means for your email
- If the CCPA applies to your business, Californians can ask to know what you hold about them, to delete it, to correct it, and to opt out of its sale or sharing.
- The Attorney General says businesses "must respond to your request within 45 calendar days", and can extend by another 45 days (90 in total) if they tell the person.
- Opt-outs of sale or sharing must be acted on as soon as feasibly possible, and within 15 business days.
- Unsubscribing from marketing emails is a separate rule (CAN-SPAM): honour it within 10 business days.
Do
- Work out which state laws apply to you: several other states now have similar privacy laws with their own deadlines.
- Log each request with a reference and its deadline when it arrives.
- Delete or export the person's data in your email platform and anywhere else it's kept, and suppress them so they aren't re-imported.
- Keep a record of what you did.
Don't
- Don't treat a deletion request as only an unsubscribe: deletion covers the data, not just the emails.
- Don't put the person's details in tools that don't need them.
Good to know
- For most CCPA violations, only the Attorney General or the California Privacy Protection Agency can take legal action, according to the Attorney General.
- Whether the CCPA applies depends on your business (for example its revenue and how much personal information it handles): check with your legal team.
Sources
- California Consumer Privacy Act (CCPA) (California Attorney General)
- California Civil Code section 1798.130 (California Legislative Information)
- California Privacy Protection Agency (CPPA)
- CCPA monetary thresholds and penalties (inflation adjustment) (California Privacy Protection Agency)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.