CCPA
California Consumer Privacy Act — gives California residents rights to access, delete, and opt out of sale of their personal data.
The California Consumer Privacy Act (CCPA), expanded by CPRA, gives California residents rights similar to GDPR's data subject rights: the right to know what personal data is collected, the right to delete personal data, and the right to opt out of "sale" of personal data (broadly defined). For email senders, the most relevant implications are the deletion right (you must delete a subscriber's data on request) and the opt-out-of-sale right (sharing email addresses with third parties for marketing may trigger sale obligations).
CCPA applies to businesses meeting size thresholds that collect personal information from California residents. International senders with California audiences are in scope. Penalties run up to $7,500 per intentional violation.
In practice, most senders comply by extending their GDPR-compliant data subject request processes to also handle CCPA requests. The two regimes overlap enough that a single privacy operation can satisfy both with minor configuration differences.