Who CCPA applies to
Your business if it meets ANY of:
- Annual revenue over $25M
- Buys/sells/shares personal data of 50,000+ California residents/year
- Derives 50%+ of revenue from selling consumer data
Most B2B SaaS teams and agencies clear the first threshold long before the other two become relevant, which is why "we don't sell data" doesn't get you out of CCPA the way founders often assume. Revenue alone is enough to bring the rest of the statute, including the rights below, into scope. And a common misreading is worth correcting directly: CCPA originally exempted personal information collected in a B2B or employment context while regulators worked out separate rules for it, but that carve-out was written as temporary from the start and expired on January 1, 2023. It was not extended. A lead's work email and job title sitting in your CRM is personal information under California law exactly the same way a consumer's data would be.
The 5 CCPA rights
- Right to know what categories of data you've collected, where from, and why. For a B2B contact this typically means: name, job title, company, LinkedIn profile URL, collected for sales outreach.
- Right to delete personal information you hold, subject to a handful of statutory exceptions (see below).
- Right to opt out of the sale or sharing of their data. Rare in practice for pure B2B prospecting tools, common for anything touching ad-tech.
- Right to non-discrimination for exercising any of the above. You cannot degrade service or charge a different price to someone who opted out or requested deletion.
- Right to correct inaccurate data, added by CPRA. If a prospect tells you their title changed, that's now a statutory right, not just good CRM hygiene.
Business, service provider, or third party
CCPA sorts every company touching a given piece of data into one of three roles, and which one you are determines who has to respond when a request comes in. If your company uses Leadsforlinked to build and manage a prospect list, your company is the "business," the entity that decided why the data is being collected and what it's used for. Leadsforlinked, acting on your instructions to extract and organize that data, sits closer to a "service provider," processing on your behalf under a data-processing agreement rather than deciding independently what to do with it. Practically, this means the compliance obligation, responding to a California resident's request about their own record, sits with your company, not with the tool. Read the vendor's DPA before assuming otherwise, since the split isn't automatic and depends on the actual contract terms.
What B2B teams typically need
- Privacy policy disclosing data collection practices, updated to reflect that B2B contacts are now covered
- Process for handling right-to-know and right-to-delete requests within 45 days (extendable once, by 45 more days, with notice)
- Documentation of data sources and retention periods, since "we don't know where this came from" is not a defensible answer to a regulator
- "Do Not Sell or Share" link only if you actually sell or share data as CCPA defines it. Standard vendor relationships under a proper DPA generally don't count
Enforcement in practice
Fine amounts adjust with inflation each year; as of 2025 the caps are $2,663 per violation and $7,988 per intentional or minor-related violation, both up from the statute's original $2,500/$7,500 figures. Class actions remain possible for data breaches involving unencrypted personal information at scale.
What's more instructive than the cap is where actual enforcement has landed. General Motors settled for $12.75M in May 2026 over selling driving and location data, the largest CCPA fine to date. Disney paid $2.75M in February 2026 for opt-out failures. Tractor Supply paid $1.35M in September 2025, and American Honda paid $632,500, both for related opt-out and consumer-choice issues. The pattern across nearly every settlement since the CCPA's first major enforcement action against Sephora is the same: a Do Not Sell link or Global Privacy Control signal that existed on paper but didn't propagate correctly through the company's actual ad-tech and vendor stack. Regulators are auditing whether opt-outs function in practice, not just whether the policy document uses the right words.
Frequently asked questions
Does CCPA apply to B2B contacts, or just consumers?
It applies to B2B contacts too. The original CCPA had a temporary carve-out for business-to-business and employee personal information, but that exemption expired on January 1, 2023, and was not renewed. A prospect's name, work email, and job title held in a CRM are personal information under the statute, business context included.
What's the actual deadline to respond to a CCPA request?
45 days from receipt, with one 45-day extension available if you notify the requester within the original window and explain the delay. That gives a hard outer limit of 90 days, but the default expectation is 45.
Do I need a "Do Not Sell or Share" link if I don't sell data?
Only if you actually sell or share personal information as CCPA defines it, which under CPRA includes some forms of cross-context behavioral advertising. Simply using a vendor like Leadsforlinked to source and manage leads under a standard data-processing arrangement is not a sale, so most B2B SaaS teams do not need the link. Confirm your own ad-tech stack doesn't cross that line before assuming it's moot.
What happens if I ignore a deletion or access request?
The automatic right-to-cure period that existed under the original CCPA was narrowed once CPRA took effect, so a warning letter before enforcement is no longer something to count on. Recent settlements, including a $12.75M case against General Motors and a $2.75M case against Disney, both centered on opt-out mechanisms that looked compliant on paper but didn't actually work end to end.
Sources: California Privacy Protection Agency, 2025 fine adjustment announcement. General information only, not legal advice; confirm current requirements with counsel for your specific situation.
CCPA-friendly tooling.
Leadsforlinked supports a 45-day deletion SLA. Free 100 leads on signup.
Start free