Marketing has always been data-driven. Every campaign depends on information: who your audience is, what they click, what they buy, which emails they open, which pages they visit, and which adverts bring them back. But under the California Consumer Privacy Act, known as CCPA, and its amendment, the California Privacy Rights Act, known as CPRA, the way marketing teams collect, use, share, and store consumer data is now heavily regulated.

For any organisation serving California consumers, the implications are significant. Your business does not need to be based in California for the law to matter. If your campaigns reach California residents and your organisation meets the relevant thresholds, your marketing practices may need to comply.

This affects far more than your privacy policy. CCPA compliance for marketing teams can involve cookie settings, advertising pixels, email lists, customer relationship management systems, third-party data providers, analytics tools, data retention, opt-out workflows, and vendor contracts. It also affects how marketers think about trust. A campaign that performs well but ignores consumer rights can expose the business to complaints, regulatory scrutiny, and reputational damage.

This guide explains what marketing teams need to know and what they need to do to keep campaigns compliant.

What do CCPA and CPRA actually require from marketing teams?

CCPA and CPRA give California consumers more control over their personal information. For marketing teams, this means being clear about what data is collected, why it is collected, who it is shared with, and how consumers can exercise their rights.

Marketing teams often handle large volumes of personal information, including names, email addresses, phone numbers, device identifiers, browsing behaviour, purchase history, location data, engagement scores, and advertising audience data. Some of this data may be collected directly through forms and campaigns. Other data may be collected through cookies, pixels, analytics tools, or third-party platforms.

How CCPA defines sale of personal data and why this affects digital advertising

Under CCPA, “sale” does not only mean selling a list of customer names for money. The concept can also cover certain types of data disclosure where personal information is exchanged for valuable consideration. This is important for digital advertising because marketers often share data with platforms, networks, analytics providers, and other partners in ways that support campaign targeting or measurement.

For example, if your website sends visitor data to a third-party advertising platform through a tracking pixel, that activity may need legal review. Even if no money changes hands directly, the data exchange may still be relevant under California privacy law marketing obligations.

This is why marketing teams need to understand how each advertising tool works, what data it receives, and whether the consumer must be given an opt-out choice.

The CPRA’s broader concept of sharing for cross-context behavioural advertising

CPRA expanded the focus from sale to include “sharing” personal information for cross-context behavioural advertising. In simple terms, this means using information about a consumer’s activity across different businesses, websites, apps, or services to deliver targeted advertising.

This matters because many digital marketing campaigns rely on retargeting, lookalike audiences, audience matching, conversion tracking, and behavioural advertising. CPRA marketing compliance requires teams to ask whether their advertising activity involves sharing personal information for this type of targeting.

If it does, consumers may need a clear way to opt out.

The key difference between CCPA and GDPR consent requirements for marketers

The General Data Protection Regulation, or GDPR, often requires a lawful basis before processing personal data. For many marketing and tracking activities, consent may be required, especially for non-essential cookies and electronic marketing in some contexts.

CCPA and CPRA work differently. They are generally more focused on notice, transparency, and opt-out rights. This does not mean marketers can ignore consent completely. It means the legal model is different. Under CCPA and CPRA, your marketing team must pay close attention to whether data is sold, shared, used for targeted advertising, or includes sensitive personal information.

In practice, global businesses often need both approaches: consent management for GDPR and opt-out management for California privacy rights.

How do consumer opt-out rights change your marketing operations?

Consumer opt-out rights are one of the biggest operational changes for marketers. They affect how campaigns are planned, launched, tracked, and measured.

The right to opt out of sale and sharing — what your marketing funnel must accommodate

A California consumer may have the right to opt out of the sale or sharing of their personal information. For marketing teams, this means the funnel must be able to recognise and respect opt-out choices.

This can affect website tracking, advertising pixels, customer data platforms, email segmentation, retargeting campaigns, and third-party audience sharing. If someone opts out, the marketing system should not continue treating that person as available for restricted data sharing or targeted advertising.

The key point is that opt-out rights must be operational, not just written in a policy. If the privacy notice says consumers can opt out, your systems must actually honour that choice.

Implementing the Do Not Sell or Share My Personal Information link correctly

Many businesses covered by California privacy law need a clear “Do Not Sell or Share My Personal Information” link. This link should not be hidden, confusing, or buried inside a long privacy policy. It should lead consumers to a simple way to exercise their opt-out rights.

For marketers, this link may connect to a consent management platform, privacy preference centre, or internal consumer rights workflow. The design should be easy to use, and the choices should be passed into the systems that control advertising and tracking.

A common mistake is adding the link but failing to connect it properly to marketing tools. That creates a compliance gap because the consumer appears to have a choice, but the back-end systems do not respect it.

Global Privacy Control marketing — the browser signal your organisation is legally required to honour

Global Privacy Control, often called GPC, is a browser or extension-based signal that communicates a user’s privacy preference. In California, businesses covered by the law may need to honour this type of signal as a request to stop selling or sharing personal information.

For marketing teams, Global Privacy Control marketing obligations are highly practical. Your website must be able to detect the signal and apply it to relevant tracking and sharing activities. This may affect cookies, pixels, tag managers, advertising platforms, and analytics tools.

If your team relies on digital advertising, do not treat GPC as a technical side issue. It is directly connected to CCPA opt-out advertising compliance.

What to do operationally when a consumer opts out — the step-by-step process

When a consumer opts out, your marketing operation should follow a clear process.

First, capture the request through the website link, privacy preference centre, GPC signal, or other approved channel. Second, verify what type of opt-out applies. Third, update the relevant systems, such as cookie tools, customer relationship management platforms, advertising audiences, data warehouses, and customer data platforms. Fourth, stop restricted sale or sharing activities for that consumer. Fifth, document the request and your response.

Marketing, legal, compliance, and IT teams should agree this workflow in advance. Waiting until the first complaint arrives is not a good strategy.

How does CCPA affect email marketing and CRM data specifically?

Email marketing and customer relationship management systems are central to most marketing teams. They also hold a lot of personal information, which means they need careful governance.

Is email marketing covered by CCPA? The consent vs opt-out question resolved

CCPA email marketing is not the same as GDPR email consent. CCPA does not generally require opt-in consent for every marketing email in the same way that some other laws may require permission for electronic marketing. However, CCPA can still apply to the personal information used in your email campaigns.

This means you should be transparent about how email data is collected, how it is used, whether it is shared, and how consumers can exercise their rights. If email data is used for profiling, matching, targeted advertising, or third-party audience creation, additional privacy obligations may arise.

Email marketers should work closely with compliance teams to ensure sign-up forms, privacy notices, unsubscribe tools, and data-sharing practices are aligned.

Data retention for marketing lists — how long can you lawfully keep California consumer data?

Marketing teams often keep contacts for too long. A person downloads one guide, attends one webinar, or enters one competition, and their data stays in the system for years.

A better approach is to set a retention schedule for marketing data. Keep personal information only for as long as it is needed for a clear business purpose. Remove inactive contacts, suppress people who have opted out, and review old campaign lists regularly.

Retention rules should be practical. For example, your team may set different periods for active customers, prospects, unsubscribed contacts, event attendees, and lapsed leads. The key is to avoid holding data indefinitely without a reason.

Purchased and rented lists — the CCPA and CPRA risk of using third-party marketing data

Purchased and rented lists can create serious privacy risk. The marketing team may not know how the data was collected, whether consumers were told it would be shared, whether the supplier had the right to provide it, or whether any opt-outs apply.

CCPA third-party data sharing makes this especially important. If your organisation receives or uses personal information from third parties, you need to understand the source, contractual terms, permitted uses, and consumer rights implications.

Before using third-party lists, ask clear questions. Where did the data come from? What notices were given? Are California consumers included? Has anyone opted out? Can the supplier prove compliance? If the answers are weak, the campaign may not be worth the risk.

Re-engagement campaigns and CCPA — how to lawfully reconnect with lapsed contacts

Re-engagement campaigns can be useful, but they should be handled carefully. If a contact has been inactive for a long time, ask whether you still have a valid reason to keep and use their data. If they have opted out, unsubscribed, or requested deletion, do not treat them as available for ordinary marketing.

A compliant re-engagement campaign should use clean data, respect suppression lists, avoid sensitive targeting, and give recipients a clear way to unsubscribe or update preferences.

What does CPRA mean for digital advertising and third-party data sharing?

CPRA has major implications for digital advertising because it directly addresses sharing for cross-context behavioural advertising and introduces stronger treatment of sensitive personal information.

Sensitive personal information in advertising — the categories CPRA now restricts

CPRA sensitive personal information advertising needs special attention. Sensitive personal information can include details such as precise geolocation, racial or ethnic origin, religious beliefs, health information, financial information, union membership, and other protected categories.

Marketing teams should be very cautious about using sensitive personal information for targeting, segmentation, or personalisation. Even where the data appears useful, the privacy risk can be high. In many cases, sensitive data should be excluded from advertising audiences unless there is a clear legal basis and strong compliance review.

Programmatic advertising and data brokers — your disclosure and contract obligations

Programmatic advertising often involves multiple parties, including advertisers, publishers, exchanges, demand-side platforms, supply-side platforms, measurement providers, and data brokers. This can make it difficult to understand where personal information goes.

Marketing teams should map the advertising ecosystem they use. Identify who receives personal information, what they do with it, whether they act as service providers, contractors, third parties, or independent businesses, and whether data is sold or shared.

Your privacy notice should accurately describe these activities. Your contracts should also reflect the actual relationship with each vendor.

Updating vendor agreements — what your contracts with advertising platforms must now contain

Vendor contracts are not just a legal formality. They define how advertising partners can use personal information. For CPRA marketing compliance, contracts may need to restrict how vendors use, retain, disclose, or combine personal information.

Marketing teams should work with legal and procurement teams before onboarding new advertising tools. Do not install a pixel, upload a customer list, or connect a platform before the contract and privacy impact have been reviewed.

A simple rule helps: no new marketing technology should go live until privacy, security, and vendor checks are complete.

Cookie consent and CCPA — is a cookie consent banner required under California law?

CCPA cookie consent is different from GDPR cookie consent. California law does not always require the same opt-in cookie banner model used in many European contexts. However, if cookies, pixels, or similar technologies sell or share personal information, support targeted advertising, or disclose data to third parties, the business may need to provide clear notice and opt-out controls.

For many organisations, a cookie banner or privacy preference centre is still a practical way to manage choices. The key is not the banner itself, but whether the controls accurately reflect and honour California rights.

How can a marketing team build a practical CCPA and CPRA compliance programme?

Compliance should be built into marketing operations, not added at the end of a campaign.

Auditing your marketing data flows and third-party tool integrations

Start with a marketing data audit. List every place where marketing collects or uses personal information. This includes website forms, landing pages, analytics tools, email platforms, customer relationship management systems, advertising pixels, data warehouses, event platforms, survey tools, and lead scoring systems.

For each tool, identify what data is collected, why it is used, where it is sent, whether it is shared with third parties, and whether it supports targeted advertising.

This audit is the foundation of CCPA compliance for marketing teams.

Updating your privacy policy and consent mechanisms for California visitors

Your privacy policy should clearly explain your marketing data practices. It should describe categories of personal information collected, purposes of use, categories of third parties, sale or sharing practices where relevant, consumer rights, and how to exercise those rights.

Consent and preference tools should match the policy. If your policy says users can opt out of sharing, your website and marketing systems must actually stop the relevant sharing.

Building a consumer rights request workflow within marketing operations

Marketing teams should not work in isolation from consumer rights processes. If a consumer asks to delete data, access data, correct information, or opt out of sale or sharing, marketing systems may need to be updated.

Create a workflow that connects privacy requests to marketing platforms. Decide who is responsible for checking campaign tools, removing contacts, suppressing records, updating audience lists, and confirming completion.

Training your marketing team — who needs to know what and how often

Training is essential because marketers make daily decisions that affect privacy. Marketing managers need to understand campaign risk. Digital marketers need to understand pixels, cookies, and advertising platforms. Email marketers need to manage consent, suppression, and retention. Data analysts need to understand audience segmentation and data minimisation. Senior marketing leaders need to understand accountability and budget implications.

Training should not be a one-off exercise. Teams should receive updates when laws, tools, or campaign practices change. A course such as CCPA And CPRA Compliance For Marketing Teams can help marketers understand the rules in the context of their actual work.

FAQs

Does CCPA apply to B2B marketing data or only individual consumer data?

CCPA can apply to personal information about California residents, including information collected in certain business-to-business contexts. If your B2B marketing database includes identifiable individuals, such as work email addresses, direct phone numbers, job titles, or behavioural data, you should review whether CCPA and CPRA obligations apply.

What is sensitive personal information under CPRA and how does it affect ad targeting?

Sensitive personal information includes higher-risk categories such as precise geolocation, racial or ethnic origin, religious beliefs, health information, financial information, and other protected data types. Marketing teams should avoid using sensitive personal information for advertising unless it has been carefully reviewed and is legally justified.

Do we need a separate Do Not Sell or Share link if we already have a GDPR cookie banner?

Possibly. A GDPR cookie banner and a CCPA “Do Not Sell or Share My Personal Information” mechanism serve different legal purposes. If your business is covered by CCPA and CPRA and sells or shares personal information, you may need a specific California opt-out mechanism even if you already operate a GDPR cookie consent banner.

Conclusion

CCPA and CPRA compliance is no longer a legal team issue that marketing can ignore. These laws directly affect how campaigns collect data, how audiences are built, how cookies and pixels are used, how third-party platforms receive information, and how consumers can opt out.

The marketing teams that perform best in this environment will be the ones that build compliance into their normal processes. That means auditing data flows, reviewing vendors, updating privacy notices, respecting Global Privacy Control signals, managing opt-outs properly, and training staff to recognise privacy risks before campaigns go live.

Good privacy practice does not have to weaken marketing. In fact, it can improve trust, strengthen data quality, and reduce wasted activity on poorly governed lists or risky third-party audiences.

Give your marketing team the CCPA knowledge they need to run compliant campaigns. Explore our dedicated CCPA And CPRA Compliance For Marketing Teams course and help your team build practical, role-specific privacy confidence.

For wider organisational awareness, you may also want to explore US State Privacy Laws Overview For Business Leaders, CCPA And CPRA Compliance For Customer Support And Call Centers, and Data Privacy Fundamentals For All Employees.