Licensing company data in California: what the CCPA changes
California is the state where the privacy law reaches furthest into a company’s ordinary records. The California Consumer Privacy Act covers the personal information of employees and of business contacts, not only of shoppers, and the state keeps a register of data brokers. A California company that licenses its email, tickets and CRM history to an AI lab has to look at both.
Where California stands
The Attorney General’s page on the CCPA lists the tests and the expired exemptions. A company under all three tests may fall outside the act, but other California rules and its customers’ contracts still apply.
| Question | Answer as of 2 November 2026 |
|---|---|
| Comprehensive privacy law | Yes. The CCPA, in force since 2020 and amended by the CPRA. |
| Who it covers | For-profit businesses that do business in California and meet one of three tests: revenue above a threshold set in the statute and adjusted for inflation, buying or selling the personal information of 100,000 or more residents or households, or earning half or more of revenue from selling personal information. |
| Employee and business contact data | Covered. The exemptions for employment and business-to-business information expired on 31 December 2022. |
| Who enforces | The Attorney General and the California Privacy Protection Agency. |
What this means for operating records
Most of a company’s records name people: employees in chat, customers in tickets, vendors in email. Under the CCPA a coworker or a business contact is a consumer like any other, so a license of those records is a sale or sharing of personal information unless the data has been de-identified to the statute’s standard.
The statute treats data as deidentified when it cannot reasonably be used to infer information about, or be linked to, a person, and the business takes reasonable measures to prevent re-identification, publicly commits not to re-identify it and requires the same of anyone who receives it. A seller who relies on that definition needs the commitment written into the license.
The data broker register
California defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship, and it requires brokers to register. A company licensing its own records to a lab has a direct relationship with its own people and customers, which usually keeps it outside that definition. The broker that arranges the deal and the lab that receives the data should each check the definition against their own facts.
If the company is closing
The act applies to a business until it stops doing business, and its duties on deletion requests do not disappear on the day the company announces a wind-down. Consumers may bring a claim after certain data breaches caused by a failure to keep reasonable security, which makes the fate of an archive of old email a live question for the people who control it. See the closing-company page.
Read next
- United States rules. The federal laws behind every state.
- Other states. What each state adds.
- De-identification. How personal detail comes out.
- Liability. Who answers for what in a deal.
Questions about licensing company data in California: what the CCPA changes
Does the CCPA cover our employees’ email?
Yes, if the company is covered. Employee data lost its exemption on 31 December 2022, so staff are consumers under the act.
Do we need to register as a data broker?
Usually not if the data is your own and you have a direct relationship with the people in it. The definition turns on selling information about people you have no relationship with.
Can customers sue us if the licensed data leaks?
After certain breaches of unencrypted, unredacted personal information caused by weak security, yes. Statutory damages are set by the act, and a notice and cure step comes first.
Didn't find your question? Ask us directly.