How California CCPA and CPRA change startup email and ad targeting

What to take away

Which businesses are covered, and the duties that follow

The CCPA gives California consumers rights over the personal information a business collects about them. The CPRA amended it, added the California Privacy Protection Agency, and tightened rules on sharing data for advertising. Both apply to for-profit businesses that do business in California and clear one of the thresholds set out below.

The thresholds are revenue, volume or income based. Annual gross revenue above $25 million in the prior calendar year, adjusted for inflation, is the first.

Buying, selling or sharing the personal information of 100,000 or more consumers or households in a year is the second. Earning 50 percent or more of annual revenue from selling or sharing personal information is the third.

The CPRA passed in November 2020, and its main obligations took effect on January 1, 2023. Enforcement by the Attorney General and the CPPA began on July 1, 2023.

A startup that clears them owes the same duties as a large retailer. If you sell to California residents and hit a threshold, you are covered even if your office is in Austin.

For acquisition teams, three duties matter most. You must tell people what you collect and why. You must let them stop the sale or sharing of their data. You must limit use of sensitive personal information.

The California Department of Justice publishes the operative text and the Attorney General's own summary of obligations. Start there rather than a vendor blog. The CCPA obligations for startup email and ad targeting cover both your CRM and your ad accounts.

Enforcement is real. The Attorney General's office brings privacy cases and consumer protection actions under the same umbrella, and its privacy and data security work sits alongside those consumer cases.

One practical point: this is not a consent-first regime like the EU's. California is opt-out for sale and sharing, with notice duties up front. Many founders assume GDPR-style consent banners solve it. They do not.

That mismatch matters when you want to know how to research startup market research across markets. A single global banner can misstate what California actually requires.

Notice, opt-out and sensitive data limits

Notice at collection for email signup and lead forms

The notice at collection is the disclosure you give at or before the moment you collect data. It names the categories you collect and the purposes you use them for. It must be easy to read and available at the point of collection.

For a startup, that means the email capture form, the webinar registration, the demo request and the checkout page. A privacy policy link in the footer is not the same thing. The notice has to be there when the data is taken.

Here is the sequence most teams should follow.

Do this before you turn on any tracking. It is far cheaper than retrofitting a notice onto a form that has been live for a year.

A line on the form itself can carry the notice. Here is a workable version for an email signup.

"We collect your email address and your IP address. We use them to send the newsletter you asked for, to measure open and click activity, and to show you ads on other platforms. We do not sell your email address. Our Privacy Policy lists every category we collect and how to opt out of sharing."

Swap in your real categories and purposes. A line copied from another company's page will not match what your pixels actually do.

Privacy requirements belong at the start of a startup co-marketing partnerships plan, not the end. If your research plan involves list building or audience testing, the notice shapes what you may collect.

Email consent is a separate track. California's privacy law does not replace federal anti-spam rules or platform policy. You still need permission to mail, and you still need to honor unsubscribes quickly.

The FTC's privacy and security guidance covers the federal layer that sits on top, including deceptive claims about what you do with data. A notice that overpromises is itself a risk.

The FCC's consumer guides cover the communications side, including rules that touch on messaging and unwanted contact. Read them before you buy a list.

Opt-out of sale and sharing for lookalike audiences

The CPRA extended the opt-out from "sale" to "sharing." Sharing means disclosing personal information for cross-context behavioral advertising, even without money changing hands. That is exactly what a pixel or a customer list upload does.

So when you upload a customer email list to build a lookalike audience, you are likely sharing personal information. Consumers can opt out. If you ignore the signal, you are out of compliance.

Opt-out signals arrive in a few forms. A consumer may submit a request through your web form. A browser or extension may send a Global Privacy Control signal. You must honor both without demanding extra steps.

The deadline is fixed. You must comply with an opt-out of sale or sharing as soon as feasibly possible, and no later than 15 business days after you receive it. You may not require the consumer to prove who they are before you act.

You may ask for the detail you need to find them in your systems, such as an email address or an account ID.

Requests to know or delete run on a different clock: 45 calendar days, extendable once by another 45 days with notice to the consumer. For those, you must take reasonable steps to verify the requester's identity before you act.

Global Privacy Control is the one teams miss. It is a browser-level signal that must be treated as a valid opt-out for that browser or device. Your tag manager has to read it and suppress the pixel.

That is easier said than done. Most ad pixels fire before any consent logic runs. The fix is to gate the tag, not to add a policy sentence.

Lookalike audiences carry a second problem: you cannot easily remove one person from a modeled audience. The practical answer is to exclude opted-out users at the source list and refresh the seed regularly.

If you cannot show who agreed and when, the audience build is the weak link.

A worked example

A seed-stage SaaS company uploads 40,000 customer emails to an ad platform each quarter. Two hundred customers submit opt-out requests. The team removes them from the CRM but not from the uploaded list.

The next upload still contains those 200 people. The company has now shared personal information after a valid opt-out. The remedy is a suppression list that runs before every upload and a log showing it ran.

Consent and sensitive data limits on pixel-based ad targeting

Pixel-based ad targeting consent is narrower than the general opt-out, but it is stricter where it applies. Two triggers matter: sensitive personal information and minors.

Sensitive data includes precise geolocation, health information, racial or ethnic origin, religious beliefs, and certain identifiers like a Social Security, driver's license or passport number. If your pixel collects precise location, you must limit its use.

You may only use sensitive data for the purposes the consumer expects, or with consent where required. Retargeting someone based on a health page visit is not a purpose they expect.

The second trigger is age. If you have actual knowledge that a consumer is under 16, you need opt-in consent before selling or sharing. Under 13, you need consent from a parent or guardian. Most startups have no age signal at all, which is its own problem.

Practical controls that work:

Retargeting is where this gets expensive. A cart abandonment pixel on a supplement store may touch health data. A fintech pixel on a loan calculator may touch financial data. Both need a purpose that holds up.

Audit your tags quarterly. Pixels accumulate. A contractor adds one for a test, it never gets removed, and it quietly collects something you never disclosed.

How other states differ from California thresholds

California is the largest state privacy regime, not the only one. Several states now have comprehensive laws, and they differ on thresholds, definitions and duties.

The table below is a starting point for triage, not legal advice.

A few differences matter for acquisition. Some states require recognition of universal opt-out signals, which California treats as one valid signal among others. Some exempt small businesses entirely. Some focus on specific data types rather than broad consumer rights.

The practical consequence is a patchwork. A national campaign with one consent flow will be wrong somewhere. Build a state map, then decide where to suppress rather than where to customize.

That is also why startup content marketing now leans toward owned channels and incrementality testing. Less dependence on third-party targeting means less state-by-state exposure.

Vendor contracts and data processing terms for ad platforms

Your ad platform and your CRM are service providers or contractors under California law. That status depends on the contract, not the logo.

A data processing agreement is what makes the relationship work. It must limit the vendor's use of your data, require confidentiality, and set terms for deletion and audits. Without it, the vendor may be a third party, and every transfer becomes a sale or share.

What to check in each contract:

Ad platforms often bury these terms in a business terms addendum. Read it. If the platform reserves the right to use your data for its own product improvement without limit, you have a problem.

Keep a current vendor register. Name the data categories shared, the purpose, the contract date and the contact. When a request arrives, you need to know which vendors hold the data.

Startup marketing metrics should include vendor terms, not just subject lines and send times. A clean list sent through a vendor with weak terms is still a weak position.

Keeping a CCPA and CPRA evidence file for acquisition channels

Enforcement usually starts with a request. You will be asked to show your notices, your opt-out process and your vendor terms. If those live in five tools and one person's memory, you will struggle.

Build one evidence file. It does not need to be software. A shared drive with dated folders works for most startups.

What belongs in it:

Review it quarterly. Tag changes in your marketing stack create new collection points, and each one needs a notice and an owner.

Assign one person. Privacy work without an owner drifts. A founder or growth lead can hold it if the checklist is short and the calendar reminder is real.

California's consumer protection work is public and active. The Attorney General's protecting consumers page shows the kind of cases that start with a complaint and end with a settlement.

None of this requires a large legal budget. It requires a notice, a suppression process, decent contracts and a file you can produce on request.

Permission records belong in that file too. A permission records precede automation habit keeps your send log and your opt-out log in one place.

Common questions