Quick Takeaways

• The CCPA B2B exemption expired on December 31, 2022.
• California business contacts now hold full CCPA consumer rights.
• CCPA compliance governs your data, while CAN-SPAM governs the send.
• Requests to know, delete or correct need answers within 45 days.
• Sharing data with ad or enrichment tools can trigger opt-out duties.
• A deletion that misses one connected system is not a deletion.

For three years, many B2B marketers treated California’s privacy law as a consumer problem. Then the B2B exemption ended on December 31, 2022, and every business contact living in California gained the same rights as any shopper. CCPA compliance became part of your email program whether your playbook noticed or not.

The gap shows up in ordinary moments: a prospect asks what data you hold on them, a partner contact asks to be deleted, or a sales leader wants to push email engagement data into an ad platform. Each one is a CCPA question, and each one touches the systems your marketing team runs every day.

This guide explains what CCPA compliance means, why it now applies to B2B data, what it requires from your email program, and how to build it into Eloqua or Marketo.

This post is for educational purposes only and does not constitute legal advice.

What Is CCPA Compliance?

CCPA compliance means meeting the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), when you collect and use the personal information of California residents. The law is enforced by the California Privacy Protection Agency and the California Attorney General.

In practice, CPRA compliance and CCPA compliance are the same work. The CPRA expanded the original law, added the right to correct data, and created the agency that now writes and enforces the rules.

Who CCPA Applies To

The law applies to for-profit businesses that do business in California and meet at least one of three tests, according to the California Privacy Protection Agency:

Revenue: Annual gross revenue of $26,625,000 or more in the preceding calendar year, the figure in effect since January 1, 2025.

Volume: Buying, selling or sharing the personal information of 100,000 or more California residents or households.

Data sales: Earning 50% or more of annual revenue from selling or sharing personal information.

Most mid-size and enterprise B2B companies pass the revenue test alone, so CCPA compliance is rarely optional for them. California is also not the only state with rules like these; see how other US state privacy laws affect your platform for the wider picture.

Does CCPA Apply to B2B Marketing Data?

Yes. The California Attorney General confirms that the temporary exemptions for employee and business-to-business information expired on December 31, 2022. Since January 1, 2023, a California business contact holds the same CCPA consumer rights as any shopper.

The end of the CCPA B2B exemption matters because B2B databases are full of California residents: buyers, champions, partners and event attendees. Their names, work email addresses, job titles and engagement history are all personal information under the law.

CCPA vs CAN-SPAM: Two Different Jobs

CCPA compliance does not decide whether you may email a California contact; CAN-SPAM does. The FTC’s CAN-SPAM compliance guide sets the rules for the send itself: honest sender details, a postal address and a working unsubscribe. CCPA governs the personal data behind the send: what you collect, why you use it, who you share it with, and what happens when someone asks.

That is why CCPA email marketing questions rarely start in the email itself. They start in forms, data syncs and integrations. For how CCPA fits alongside CAN-SPAM, CASL and GDPR, see our B2B email compliance guide covering CAN-SPAM, CASL, GDPR and CCPA.

What CCPA Requires From Your Email Program

CCPA compliance for an email program comes down to four obligations.

Notice at Collection

Tell people what personal information you collect and why, at or before the point you collect it. For marketers, that means every form, event registration and gated asset should point to a privacy notice that describes your actual practices.

Requests to Know, Delete and Correct

CCPA consumer rights include the right to know what data you hold, to delete it, and to correct inaccurate data. The Attorney General’s guidance gives businesses 45 calendar days to respond, with one 45-day extension if you notify the person.

The hard part is reach. A contact may exist in your marketing platform, your CRM, a webinar tool and a data warehouse. Our guide to automating data subject requests covers intake, identity verification and fulfillment across systems.

Opt-Out of Sale or Sharing

California residents can opt out of the sale or sharing of their personal information, and opt-out requests must be handled within 15 business days. This is not the same as an email unsubscribe. A contact can keep receiving your newsletter and still opt out of having their data shared.

For marketers, “sharing” often means passing contact or engagement data to ad platforms for cross-context advertising, or to some enrichment and tracking vendors. Whether a specific flow counts depends on the details, so review each integration with your privacy team. Businesses must also honor browser opt-out signals; see our article on California browser opt-out signals.

Penalties and Business Risk

CCPA penalties are set per violation. The agency’s current adjusted amounts are up to $2,663 per violation and up to $7,988 per intentional violation. Because a single flawed process can affect thousands of records, the per-violation model adds up quickly.

The fine is rarely the biggest cost. Enforcement work pauses campaigns, freezes data flows to sales and ad platforms, and pulls your team into audits.

How to Build CCPA Compliance Into Eloqua or Marketo

CCPA compliance only holds when your marketing platform enforces it automatically. Five steps cover most B2B email programs.

Flag California contacts at entry: Capture country and state on forms and imports so you can identify California residents and apply the right rules from day one.

Route requests into a workflow: Send every request to know, delete or correct into a tracked workflow with a due date, not into a shared inbox.

Propagate deletions and opt-outs: Make sure a deletion or sharing opt-out reaches your CRM, ad audiences and every connected tool, not just the marketing platform.

Review every outbound data flow: List each integration that sends contact or engagement data out of Eloqua or Marketo, and confirm whether it could count as sale or sharing. This is the step most CCPA compliance reviews uncover problems in.

Keep records you can show: Log each request, the actions taken and the response date. A clear record is your best evidence if a regulator asks.

Running these steps by hand breaks as volume grows, which is why most teams automate them. For the broader case for privacy in marketing, read why data privacy matters for marketers.

How to Achieve B2B Privacy Compliance with 4Comply

4Comply gives your team one system of record for who consented to what, when, and under which regulation, so CCPA compliance runs inside your campaigns instead of beside them.

• Rights request handling: Automates the intake, verification, tracking and fulfillment of requests to know, delete and correct.
• Consent records and audit trail: Records when and how consent was collected and keeps an immutable audit trail you can show a regulator.
• Jurisdiction logic: Resolves a contact’s country or state to apply the right regulation, including CCPA.
• Real-time permission checks: Verifies whether permission exists before a communication goes out.
• Native Eloqua and Marketo integration: Connects to both platforms natively, with a REST API for your other systems.

See how 4Comply automates CCPA compliance →

Conclusion

The end of the B2B exemption turned California privacy law into an everyday marketing operations task. CCPA compliance does not change who you can email, but it does change how you collect, share and answer for the data behind every send. Teams that flag California contacts, route requests into a real workflow and push deletions to every system can meet the law without slowing campaigns down. If you want help building that workflow into Eloqua or Marketo, contact us and ask how 4Comply can support your CCPA compliance program.

About 4Thought Marketing
We're a B2B marketing automation and AI consultancy with a thing for getting complex tech to actually work. Since 2008, we've helped hundreds of organizations across financial services, technology, manufacturing, and real estate get more from Eloqua, Marketo, and their CRM integrations. We serve our clients across marketing automation strategy, lead lifecycle, AI, compliance, preference management, and more. Explore our services or get in touch.

Frequently Asked Questions