CCPA Opt-Out

Manage California privacy compliance

CCPA Opt-Out

The California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), grant California residents specific rights regarding their personal information. If your email marketing reaches California-based contacts, you need to understand and support these rights within Mailnaptic.

Key CCPA Rights

Under CCPA, California residents have the right to:

• Know: Request disclosure of what personal information you collect, use, and share.
• Delete: Request deletion of their personal information.
• Opt out: Direct you to stop selling or sharing their personal information.
• Non-discrimination: Not be penalized for exercising their privacy rights.
• Correct: Request correction of inaccurate personal information.

Do Not Sell or Share

CCPA requires a "Do Not Sell or Share My Personal Information" mechanism. While Mailnaptic does not sell personal data, if you share contact data with third-party integrations (advertising platforms, analytics services, etc.), you may need to honor opt-out requests. To manage this:

• Add a custom field to contacts called something like ccpa_opt_out (boolean type).
• When a contact exercises their CCPA opt-out right, set this field to true.
• Create segments that exclude contacts with ccpa_opt_out = true from any data sharing workflows.
• Use campaign exclusion segments to prevent opted-out contacts from being included in campaigns that involve third-party tracking pixels or integrations.

Handling Deletion Requests

CCPA deletion requests can be fulfilled using Mailnaptic's hard delete feature, the same tool used for GDPR right-to-erasure requests. Navigate to the contact's detail page, select Actions → Hard Delete, and confirm. This permanently removes all personal data associated with the contact.

Handling Access Requests

When a California resident requests to know what data you hold, use the DSAR export feature to generate a comprehensive data package. CCPA requires you to respond within 45 days (with a possible 45-day extension).

Record Keeping

CCPA requires you to maintain records of privacy requests and how they were handled for at least 24 months. Mailnaptic's audit log automatically records all hard deletes, data exports, and significant account actions. You can export audit log entries for your compliance records.

Privacy Policy Requirements

Ensure your privacy policy discloses the categories of personal information you collect through email marketing (identifiers, internet activity, commercial information) and the business purposes for which it's used. Link to your privacy policy from your preference center and email footer.

Verification

Unlike GDPR, CCPA allows you to verify the requester's identity using a reasonable method proportional to the sensitivity of the data. For email marketing data, confirming the request came from the email address on record is generally sufficient.