How privacy law affects your mailing list
See how the state privacy framework treats a marketing list, what consent has to look like and which lists cannot be salvaged.
What the law sees when it looks at your list
You hold a spreadsheet or a list inside an email platform. Names, email addresses, phone numbers, perhaps a city and a past purchase. To you it is a marketing asset built over years. Under California's privacy law it is personal information and you are the business holding it.
That word matters because the obligations attach to the holder rather than to the collector. It does not help that an intern built the list in 2019 or that a vendor supplied it. If the data is in your platform today the responsibility is yours. These rules also reach organisations outside the state that process the personal information of residents there in connection with offering goods or services to them.
What this does not cover and what compliance costs
It does not reach every business. Whether these statutes apply to you at all turns on applicability tests set state by state so the first question is whether you are in scope. Information already regulated under sector rules for health or financial data is generally carved out and handled there instead. Publicly available information and properly de-identified or aggregate data sit outside as well.
The cost is engineering and discipline rather than fees. Consent has to be captured with a notice attached and that notice version has to be retrievable later. Withdrawal has to be as easy as giving consent was. Erasure has to actually remove the record from the platform and from any export sitting in somebody's downloads folder. A grievance contact has to exist and be published. Where you pay a developer or a consultant for that work the fee is quoted before tax. A qualified lawyer should confirm what applies to your own processing.
Whose list is fine and whose is not
A list built from your own customers and from people who filled a form on your own website with a visible notice is in reasonable shape. The work ahead is documentation rather than reconstruction.
A purchased database is not salvageable and this is the part nobody wants to hear. If the contacts never gave you consent then mailing them to ask for consent is itself processing you had no basis for. Agencies sell re-permissioning campaigns for exactly this situation. The honest remedy is deletion. A business whose growth plan rests on a bought list of fifty thousand contacts does not have a compliance problem to fix. It has a plan that needs replacing with one that collects data first hand. Scraped lists sit in the same place however technically clever the scraping was.
How consent is meant to work
The mechanism is notice and choice. A notice has to be given at the point of collection describing the categories of personal information collected, the purpose it will be used for, whether it is sold or shared, how a request can be made and how a complaint reaches the regulator. Where you sell or share data or use it for targeted advertising the individual has to be able to opt out, and that route has to be easy to find. A pre-ticked box is not a choice. Sensitive categories and the data of children need affirmative permission rather than an opt-out.
Use is also tied to purpose. Data collected to deliver an order was not collected for a weekly newsletter. A deletion request has to be honoured unless retention is required for a legal reason. Separately, commercial email carries its own rules: an accurate sender and subject line and a working opt-out honoured promptly. Your email platform is a service provider acting for you and that relationship is expected to sit under a contract with specified terms.
Judging whether your list is defensible
The flattering metrics are list size and open rate. A large list with strong engagement can still be entirely undocumented.
The metric that matters is provenance coverage. For what proportion of your contacts can you produce the date of consent, the form or channel it came through and the notice text shown at that moment. Then measure how long a withdrawal request takes to be fully honoured across every system including exports and backups. Those two numbers describe your actual position.
The common mistake
The expensive error is treating the unsubscribe link as the whole of compliance. An unsubscribe facility handles withdrawal. It says nothing about whether consent ever existed and it creates no record of a notice. Businesses assume a working unsubscribe link places them on the right side of the line and it does not.
The cost arrives all at once. When provenance is finally required the only route is a re-permission exercise and a list with weak provenance typically collapses to a small fraction of its size. An owner who discovers this during a diligence exercise or after a complaint is making the discovery at the worst possible moment. Recording consent properly from today costs almost nothing. Reconstructing it later is not possible at all.
A note on timing
State privacy statutes have come into effect in waves and more states keep joining them. What is enforceable where you operate at the moment you read this may differ from what is enforceable now. No penalty figure or compliance deadline is stated here for that reason. A qualified lawyer should confirm the current position for your organisation.
This guide explains how something works. It is not legal, tax or financial advice, and rules change. Confirm anything regulatory with a qualified professional before you act on it.