CCPA Compliance for Data Enrichment Vendors and Users

If GDPR is the regulation that gets the most attention in enrichment compliance conversations, the CCPA (California Consumer Privacy Act) and its amendment, the CPRA, are the ones that most US-based teams quietly ignore. That is a mistake. California has 40 million residents and the CCPA applies to any business that collects personal information from California consumers, regardless of where the business is located.

For teams using data enrichment, CCPA creates specific obligations that differ from GDPR in important ways. Let us walk through what actually matters.

Does CCPA Apply to You?

CCPA applies to for-profit businesses that meet any one of these thresholds:

• Annual gross revenue over 25 million dollars
• Annually buys, sells, or shares the personal information of 100,000 or more California residents, households, or devices
• Derives 50 percent or more of annual revenue from selling or sharing California residents' personal information

If you are enriching contact data that includes California residents (and in B2B, it almost certainly does), you likely meet the 100,000 threshold when you factor in all contacts across your CRM, enrichment queries, and marketing databases.

What CCPA Considers Personal Information

CCPA defines personal information broadly. For enrichment purposes, the following all qualify:

• Name and email address (including work email)
• Phone numbers (including work direct dials and mobile)
• Job title and employer
• Professional or employment-related information
• IP addresses and online identifiers
• Geolocation data

Notably, CCPA does not distinguish between personal and professional data the way GDPR practitioners often do. A work email address is personal information under CCPA just as much as a personal Gmail address.

Key CCPA Requirements for Enrichment

Right to Know

California consumers have the right to know what personal information you have collected about them, the categories of sources, the business purpose for collection, and the categories of third parties you share it with. You must be able to respond to these requests within 45 days.

For enrichment, this means you need to track which contacts in your CRM were enriched, what data was added, and which enrichment vendors provided it. If a California resident asks what data you hold, you need to include the enriched data in your response.

Right to Delete

Consumers can request deletion of their personal information. When you receive a deletion request, you must delete the data from your systems and direct your service providers (including enrichment vendors) to delete it as well.

This means your enrichment workflow needs to support deletion propagation. If you delete a contact from your CRM, the deletion should also flow to any systems where enrichment data is stored.

Right to Opt Out of Sale/Sharing

CCPA gives consumers the right to opt out of the sale or sharing of their personal information. Under the CPRA amendment, sharing includes making data available to third parties for cross-context behavioral advertising.

For enrichment, this primarily affects vendors rather than users. But if you share enriched contact data with third parties (like partners, resellers, or advertising platforms), you may be selling or sharing under CCPA's definition. Ensure your vendor contracts explicitly prohibit secondary use of the data.

Vendor Contracts

CCPA requires specific contractual provisions when you share personal information with service providers. Your contracts with enrichment vendors must:

• Specify the business purpose for the data processing
• Prohibit the vendor from retaining, using, or disclosing the data for purposes other than the contracted service
• Prohibit the vendor from selling the data
• Prohibit combining the data with other sources for purposes outside the contract
• Require the vendor to comply with CCPA obligations

CCPA vs. GDPR: Key Differences for Enrichment

• Legal basis: GDPR requires you to establish a legal basis (like legitimate interest) for processing. CCPA does not require a legal basis but gives consumers rights to know, delete, and opt out.
• Consent model: GDPR is opt-in for many processing types. CCPA is opt-out (you can process unless the consumer opts out).
• B2B exemption: CCPA historically had a partial B2B exemption, but this has been narrowing. Do not assume B2B data is exempt.
• Private right of action: CCPA allows consumers to sue directly for data breaches involving unencrypted personal information. GDPR enforcement is through regulatory authorities.
• Financial penalties: CCPA penalties: up to 7,500 dollars per intentional violation. GDPR penalties: up to 4 percent of global annual revenue.

Building a CCPA-Compliant Enrichment Process

1. Map your data flows. Document where enrichment data enters your systems, how it moves through your pipeline (enrichment vendor to CRM to outreach platform), and where it is stored. This mapping is essential for responding to consumer requests.
2. Update your privacy policy. Disclose that you use data enrichment services, what categories of personal information you collect through enrichment, and the business purposes for this collection.
3. Implement a consumer request workflow. Build a process for receiving and responding to CCPA requests (know, delete, opt out) within the 45-day deadline. Include enrichment data in your response scope.
4. Review vendor contracts. Ensure all enrichment vendor contracts include the required CCPA provisions, especially restrictions on secondary use and selling of data.
5. Set up a Do Not Contact list. Maintain a suppression list of consumers who have opted out or requested deletion. Check this list before every outreach campaign.
6. Implement data retention limits. Do not keep enrichment data indefinitely. Set retention periods and automate deletion of data that exceeds them.
7. Train your team. Sales and marketing teams need to understand what to do when a prospect or contact invokes their CCPA rights during a conversation. Have a clear escalation process to your privacy or legal team.

The Bottom Line

CCPA compliance for data enrichment is less complex than GDPR but still requires deliberate effort. Map your data flows, update your privacy policy, implement consumer request workflows, and ensure your vendor contracts include the required restrictions. The opt-out model means you can enrich and outreach freely as long as you respect consumer requests when they come. But you need the infrastructure to handle those requests efficiently and completely when they do arrive.