Guide to California Email Marketing Laws

If you’re building an email list, selling digital products, or running promotions from the Golden State, or sending emails to anyone who lives there, California email marketing laws are not something you can afford to overlook.

As a lawyer for online entrepreneurs, I understand how easy it is to stumble into legal hot water because someone assumed complying with national rules like CAN-SPAM were “good enough.” Spoiler: they’re not. California has its own set of rules layered on top of federal regulations. That means if you’re not tailoring your email practices to align with California’s stricter standards, you could be risking penalties and your audience’s trust.

So, what exactly do California email marketing laws require? And how does the CCPA impact email marketing strategies? Here’s the no-nonsense breakdown.

Legal Disclaimer: This post is for educational purposes only and does not constitute legal advice. Read full disclaimers.

What Are California Email Marketing Laws?

California email marketing laws refer to a collection of state-level rules that govern how businesses can collect, use, and share email addresses, especially when it comes to consumer privacy. The two major legal frameworks at play here are:

• California Consumer Privacy Act (CCPA), which enhances email privacy rights and puts obligations on businesses handling personal data
• California’s anti-spam law (Business and Professions Code § 17529), which regulates commercial email content and opt-in requirements

These state rules work alongside the federal CAN-SPAM Act, but they go further, particularly when it comes to consent and the sale of personal information.

The CCPA and Email Marketing

If you’ve googled “CCPA email marketing,” you’re probably wondering: does this law even apply to my emails?

Yes, if you’re collecting emails from California residents and your business meets at least one of these criteria:

• Has annual gross revenue over $25 million
• Buys, sells, or shares the personal data of 100,000+ consumers, households, or devices
• Derives 50% or more of its revenue from selling personal information

Under the CCPA, an email address is considered personal information. That means you must:

• Inform users at the point of collection what data you’re collecting and how it will be used
• Offer a clear, accessible opt-out option if you sell or share that information
• Include a “Do Not Sell My Personal Information” link on your site if applicable
• Provide consumers with access to their data upon request, and delete it if they ask

So, is it illegal to sell email addresses? In California, if you do so without proper notice and opt-out mechanisms, yes, it can be.

Does the CCPA Apply to All Online Businesses?

If you’re a small business just starting out, you might be wondering: “Does all this CCPA stuff even apply to me?”

In many cases, it doesn’t. Many small businesses won’t hit the CCPA threshold numbers listed in the section above. So if you’re running a small online business, collecting email signups, and making money from a few affiliate programs or digital products, you’re likely not legally required to comply with the CCPA, at least not in full.

But don’t tune out just yet. Even if you’re under the threshold, CCPA principles are worth following. Here’s why:

• You probably have California readers, and they expect transparency
• Privacy-forward practices are becoming the norm, not the exception
• Bigger brand partnerships may require CCPA-aligned policies as part of their contracts
• If your blog grows, you might fall under the law in the future, and it’s easier to build privacy in early than retrofit it later

Bottom line? You may not have to follow every aspect of CCPA yet, but acting like you do is a smart move. Especially if you’re collecting email addresses or sharing user data with ad networks, sponsors, or analytics tools.

Consent: Express vs. Implied in California Email Laws

California doesn’t use the exact opt-in laws framework as the EU’s GDPR, but consent still matters.

U.S. law generally allows unsolicited commercial email as long as the message complies with CAN-SPAM and does not use deceptive practices. Obtaining consent is strongly recommended but not always legally required.

But here’s the catch: California’s anti-spam law prohibits deceptive subject lines and false header information even if you have implied consent. And if you’re emailing someone who hasn’t actively opted in, you better tread carefully.

Also, while federal CAN-SPAM allows unsolicited marketing emails as long as there’s an opt-out, California law makes sending misleading emails punishable with fines of up to $1,000 per email, up to $1 million per incident.

Required Disclosures and Opt-Out Rules

Under both federal and California email marketing laws and regulations, your emails must:

• Provide a valid physical mailing address
• Include a functioning, easy-to-use unsubscribe link (and honor opt-outs within 10 business days)

But California takes things a step further by prohibiting:

• The use of deceptive “From,” “To,” or subject lines
• Using third-party email harvesters or bots to gather addresses
• Forging headers or disguising your domain

Even if you use an email marketing platform (like Mailchimp or Kit), you are still legally responsible for complying with California law. So make sure your provider’s tools support CCPA compliance.

What About Breach Notifications?

If your subscriber data is compromised, California’s data breach notification law kicks in.

Any time an unauthorized person accesses unencrypted personal information (like emails combined with names, passwords, or other identifiers), you must notify affected California residents without unreasonable delay.

Failing to notify users properly could land you in deep legal and reputational trouble, so have a plan in place just in case.

How to Stay Compliant with California Email Marketing Laws

Here’s a checklist to keep your email practices on the right side of the law:

• Collect only what you need, and disclose why you’re collecting it
• Obtain clear consent where possible (double opt-in is a best practice)
• Avoid misleading subject lines or sender info
• Include a visible unsubscribe link in every message
• Post a compliant privacy policy outlining your email practices
• If you sell or share email addresses, offer a CCPA-compliant opt-out
• Regularly audit your email marketing tools and vendors for compliance

Bonus tip: Keep a record of how and when each subscriber gave consent. If anyone questions your list, you’ll be glad you did.