How CCPA and CPRA change omnichannel digital planning for California brands

What to take away

How CCPA and CPRA split customer data into sensitive and non-sensitive categories

California does not regulate customer data as one blob. The CCPA, at Civil Code 1798.140, defines personal information broadly, then carves out a narrower category called sensitive personal information.

The sensitive list covers government identifiers such as Social Security, driver's license and passport numbers. It covers account log-in plus password or security question. It covers precise geolocation, racial or ethnic origin, religious beliefs, union membership, and the contents of mail, email and text messages where the business is not the intended recipient.

It also covers health, sex life and sexual orientation data.

That last item, message contents, is the one that quietly reshapes omnichannel work. A retail brand reading a customer's email to a friend is handling sensitive data even if the message says nothing about health.

Non-sensitive personal information still carries duties. Identifiers, commercial information, internet activity, geolocation that is not precise, and inferences drawn from any of it all fall inside the definition. The difference is the extra rights attached to the sensitive tier.

For planners, the practical split runs by field, not by system. A CRM record can hold a loyalty ID, which is ordinary personal information, and a precise store-visit coordinate, which is sensitive.

Sensitive personal information gets three extra limits. A consumer can limit the use and disclosure of it to purposes the statute allows. A business cannot use it to infer characteristics about a consumer. And a business that collects it must say so at or before collection.

California rights extend beyond the sensitive tier. Consumers can know what is collected, delete it, correct it, opt out of sale or sharing, limit sensitive use, and avoid retaliation for exercising any of those rights. The California Attorney General publishes those rights and the matching business obligations in one place, at the official CCPA guidance.

Budget the mapping work before the campaign work. A brand that cannot say which field is sensitive cannot lawfully decide where that field may travel. Teams comparing California against other states can line up the differences against the US state privacy laws that touch the same audience files.

What the CCPA statute says about data movement between email, paid media, retail and CRM

The statute regulates movement through three defined verbs: sell, share and disclose. Each has a different trigger and a different consumer control.

A sale is a transfer of personal information for monetary or other valuable consideration. A share is a transfer for cross-context behavioral advertising, whether or not money changes hands. A disclosure is any release of personal information to another party, including a service provider.

Email sits closest to the consumer. Sending a marketing message to an address the brand collected directly is generally a permitted purpose, provided notice was given and the consumer did not opt out. Appending third-party data to that profile is a different act and needs its own basis.

Paid media is where most California brands create a sale or share without meaning to. Uploading a hashed customer list to an ad platform for matching and targeting is a share under the statute. The consumer can stop it through an opt-out, and the brand must honor a browser-based opt-out preference signal.

Retail adds offline data. In-store Wi-Fi, point-of-sale loyalty scans and precise location pings can produce sensitive personal information. Moving that data into a media platform is a disclosure, and using it to build ad audiences raises the sensitive-use limit.

CRM is the connective layer, so it is where the audit trail lives. Every field that leaves the CRM should carry a recorded purpose, a lawful basis and a destination. Without that record, a brand cannot answer a consumer request or a regulator.

Notice sits underneath all four channels. A business must tell consumers the categories collected, the purposes, the categories of third parties receiving them, and the retention period, at or before collection. A privacy policy written for the website alone will not cover a retail loyalty program.

Verifiable requests are the other constant. Access and deletion requests must be honored across channels, which means email suppression lists, ad platform audiences and CRM records have to be reachable from one workflow. Deletion is the hard case, because ad platforms and retail systems hold copies that a brand may not control directly.

CPRA amendments that change opt-out and consent planning for California brands

The California Privacy Rights Act amended the CCPA rather than replacing it. It created the California Privacy Protection Agency, added the sensitive personal information tier, and gave opt-out rights a technical shape.

The opt-out preference signal is the amendment that most changes planning. A business that sells or shares personal information must treat a browser or device signal as a valid opt-out for that consumer, without requiring an account.

Consent is now defined narrowly, as a freely given, specific and informed agreement. The CPRA also introduced the idea of a dark pattern, meaning a user interface that subverts or impairs a consumer's choice. A consent banner that makes opting out harder than opting in is exposed on that basis.

Contracts changed too. The CPRA required the agency to issue regulations on service provider, contractor and third-party relationships, and those rules set out what a compliant agreement must say about limited use, subprocessors, audits and deletion.

Retention is a new planning input. A business must disclose how long it keeps each category and must not keep personal information longer than reasonably necessary for the disclosed purpose. An audience segment built from a two-year-old purchase list needs a stated retention window.

Risk assessments and cybersecurity audits apply to higher-risk processing, which can include large-scale profiling and sensitive data use. The agency has been building out those rules, and brands that run cross-channel profiling should track them.

Enforcement is shared. The California Department of Justice brings CCPA actions and also runs the state's broader privacy and data security work, described on its privacy and data security page. The agency can pursue its own administrative actions. Both routes should shape how a brand documents its channel decisions.

Where the FTC privacy and security guidance overlaps with California obligations

California law is not the only exposure. The Federal Trade Commission polices unfair or deceptive practices under Section 5 of the FTC Act, and it has brought cases over privacy notices, data security and the use of sensitive data for advertising.

That means a single campaign can face two regulators with different theories. The California Department of Justice can argue a CCPA violation. The FTC can argue that the same conduct was deceptive because the privacy policy said something the data flows did not do.

The FTC's published privacy and security guidance is the practical reference for the second theory. It treats a privacy promise as a commitment, so a brand that says it does not share data with ad partners and then uploads a customer list has a problem independent of CCPA.

Precise location and health-adjacent data draw particular attention. Both are sensitive under California law and both have featured in FTC actions about unfair data use. A retail media plan that uses store visit data to target health-related audiences sits in the overlap.

Security is the other shared ground. California gives consumers a private right of action for certain breaches involving unencrypted personal information. The FTC pursues unreasonable data security separately. One weak vendor connection can trigger both.

Other federal statutes layer on top. The CAN-SPAM Act governs commercial email, and the Children's Online Privacy Protection Act restricts data collection from children under 13, which matters for retail brands with toy, apparel or gaming lines.

The FTC is not the only federal touchpoint to plan around, but it is the one whose theories most often mirror a state privacy claim. Document what the brand says in public, then make the channel data flows match it.

Building an omnichannel digital planning data map that survives a California audit

A data map is the artifact that answers an audit. It lists each data element, where it is collected, where it is stored, who receives it, why, and how long it stays. Build it field by field rather than system by system.

Start with collection points. Website forms, email signup, loyalty enrollment, point of sale, in-store Wi-Fi, call center notes and app permissions each produce different fields and different notice duties.

Then assign each field a classification. Ordinary personal information, sensitive personal information, or neither. Precise geolocation and account credentials go in the sensitive column. A hashed email used for matching is ordinary personal information but still triggers share rules.

Next, record every destination. Ad platforms, data clean rooms, email service providers, retail media networks, analytics vendors and CRM instances all count. For each one, note the contractual role: service provider, contractor, third party or none.

Then attach a purpose and a retention period to each flow. A purpose like "measure campaign performance" supports a narrower transfer than "build lookalike audiences." Retention should be a number of months, not "as needed."

Finally, map the consumer-facing controls. Where does an opt-out land, how does it propagate, and how fast. A signal received on the website should suppress the same consumer in email, paid media and retail media within a defined window.

Use a simple register to keep it readable:

A map like this does three jobs. It supports the notice a brand publishes. It answers a consumer request. And it shows a regulator that the brand knows where data goes.

Keep it current. Campaign launches, new ad partners and vendor changes all alter the map, so assign an owner and a review cadence. Reviews that happen only at annual planning time will lag the media plan.

Teams that rebuild channel flows after a compliance review often find the same fixes improve performance, which is the theme running through this guide to cannabis digital marketing compliance us.

Service provider and third-party contracts that govern cross-channel data sharing

The contract decides the legal character of a transfer. Get the role wrong and a permitted business purpose becomes a sale.

A service provider processes personal information on a business's behalf for a disclosed purpose. A contractor does similar work but is a distinct category under the amended statute. A third party is anyone else, and transfers to a third party can be a sale or share.

Compliant agreements must limit the recipient to the specified purpose, require compliance with the statute, allow the business to monitor compliance, require notice of subcontractors, and require deletion or return of data when the relationship ends.

Audit clauses matter more than they look. If a brand cannot verify what an ad partner does with a matched audience, the limited-purpose promise is unenforceable in practice.

Retail media networks are a common gap. Many operate as third parties for targeting while also acting as service providers for measurement. The same contract may need to separate those two roles.

Data clean rooms are another. A clean room can reduce exposure by keeping raw data inside the environment, but the transfer in and the output segments still need a lawful basis and a contract that names the role.

Cross-border and cross-state transfers add a layer. A vendor processing California residents' data from another state is still bound by the CCPA. Where several state laws apply, the contract should meet the strictest standard rather than the average.

Benchmarks for what good channel performance looks like are worth reading alongside the legal work, since common digital marketing strategy questions show where teams typically over-collect relative to what they use.

Practical steps for California marketers moving audiences between channels

These steps assume a retail or DTC brand with email, paid media, retail and CRM in scope.

A pre-launch checklist keeps the sequence honest:

Two operational habits carry most of the weight. First, treat the suppression list as production infrastructure, because a broken sync is a compliance failure with a marketing cause. Second, document decisions when they are made, since reconstructing why an audience was built is far harder months later.

Small teams can borrow the sequencing from a lean omnichannel media planning workflow, which puts compliance gates at the same points as creative and budget approvals. Larger teams should assign a named owner per channel and a single owner for the map.

Escalation paths matter too. Consumer complaints in California can reach the Attorney General's consumer protection function, which handles a broad set of marketplace complaints, as described on the office's protecting consumers page. Knowing which office receives what, and who in the company answers, shortens the response.

Finally, keep the enforcement directory handy. Attorneys general differ by state in posture and priorities, and the state attorneys general directory is the fastest way to confirm the right office when a brand operates beyond California.

Common questions