California and Colorado privacy rules for newsletter audience data

What to take away

How CCPA and CPRA reach a newsletter list

The California Consumer Privacy Act treats an email address as personal information when it can be linked to a person or household. That covers almost every newsletter list. Collect names, emails, open data or payment records from California readers and the law reaches you even when your business sits in another state.

The CPRA amended the CCPA and added the rights publishers actually field. A California reader can ask what you hold, ask you to delete it, ask you to correct it, and opt out of sale or sharing. Sharing includes handing a list to an ad partner for cross-context behavioral advertising, which many operators do without calling it a sale.

The California Attorney General enforces the statute and has settled with businesses over ignored deletion requests and missing opt-out links. The California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General sets out the rights your signup flow and privacy page have to honor.

Three thresholds decide whether the CCPA binds a small publisher. You qualify if you gross more than $25 million a year, if you buy or sell personal information from 100,000 or more consumers or households, or if you earn half your revenue from selling personal information.

A paid newsletter with a few thousand subscribers usually falls outside all three.

A free list monetized through sponsors and data partners can cross the second test quickly.

Below the threshold, the commercial case still holds. Advertisers ask for privacy terms in insertion orders. Stripe and PayPal require a posted privacy policy. A clear policy also helps you grow a newsletter audience, because readers who trust the signup form stay subscribed longer.

Know what counts as personal information on your list. An email address, a name, a postal address, an IP address, a device identifier and a record of pages someone viewed on your site all qualify. So does an inferred interest segment such as "runner" or "parent" once you attach it to a person.

What a California request looks like

A reader emails and asks for a copy of everything you hold. You have 45 days to respond, extendable once by another 45 with notice. Verify the request, deliver the categories and specific pieces of information, and log it for 24 months.

Deletion follows a different path. You delete the record, tell your email service provider and every processor to delete it, and confirm to the subscriber. You may keep a minimal suppression record so you do not email them again, plus data needed for legal or security purposes.

Colorado Privacy Act obligations for subscriber data

The Colorado Privacy Act took effect in 2023 and covers businesses that control or process the personal data of 100,000 or more Colorado consumers a year, or 25,000 consumers while earning revenue from selling personal data. Those thresholds sit below California's, so a mid-sized list with a data-driven sponsor deal can qualify.

Colorado uses different words for the same ideas. Subscribers there have rights to access, correct, delete and obtain a portable copy of their data. They can opt out of targeted advertising, profiling and the sale of personal data. You must honor a universal opt-out signal, which means watching for the browser and device signals that say no.

Consent is stricter in Colorado for sensitive data. Precise location, racial or ethnic origin, religious beliefs, health data and sexual orientation count as sensitive. If your newsletter asks readers about health, politics or religion, you need clear affirmative consent before processing that data for anything beyond delivering the email they asked for.

The Colorado Attorney General enforces the CPA through the office's consumer protection section, which also handles deceptive trade practice complaints. The Colorado Privacy Act (CPA) - Colorado Attorney General | Colorado Attorney General explains the rights and controller duties that apply to subscriber records.

Colorado gives you 45 days, with a 45-day extension when you tell the subscriber why. Refuse a request and you must explain the reason and tell the reader how to appeal. Appeals come to you first, then to the attorney general if you deny them.

A data protection assessment is required for certain high-risk processing. Selling personal data or processing sensitive data for targeted ads usually triggers one. Write it down, keep it current, and treat it as an internal document you can produce on request.

Where the two states differ

Consent, opt-out and deletion rights on a list

Consent starts at the signup form. A prechecked box is not consent in either state. Ask the reader to take an affirmative step, say what they will receive and how often, and keep a record of when and how they agreed.

Email consent is separate from privacy consent. CAN-SPAM sets the federal baseline for commercial email, including a working unsubscribe link and a physical address. State privacy law adds a second layer governing the data behind the list, not just the messages you send.

Opt-outs arrive in three forms. A reader unsubscribes from email. A reader opts out of sale or sharing. A reader sends a universal opt-out signal from a browser or device. Route all three into one suppression system, so someone who opts out of data sharing stops receiving sponsor-targeted segments.

Deletion is the hardest to satisfy because subscriber data spreads. Your email service provider holds the address. Your payment processor holds the transaction. Your analytics tool may hold a hashed identifier. Your backup holds an older copy.

A deletion request has to reach each of those systems, through your own action or a contract that makes the vendor act on your instruction. Build a path that names each one. Verify the person, delete or de-identify the record in the live list, send deletion instructions to processors, and confirm in writing.

Keep a suppression entry with the address and the date, so you can prove you stopped contacting them.

Some data survives. Records needed to complete a transaction, detect security incidents, or meet tax and legal duties are usually exempt. Sell subscriptions and your payment and accounting records may need to outlast a deletion request. Say so in the policy so the reader is not surprised.

Readers who understand what you do with their data are less likely to mark your email as spam, and your newsletter audience analytics will show fewer complaints and better deliverability over time.

Worked example: a deletion request from a Colorado reader

A reader in Denver asks you to delete everything you hold. You verify the request through the email address on file. You delete the profile in your email service provider, remove the segment tags in your CRM, and send a deletion instruction to your analytics vendor under your data processing agreement.

You keep a suppression record with the address and today's date. You reply within 45 days, confirm the deletion, and note that a minimal suppression record remains to prevent future contact. You log the request and the date.

Data security expectations for subscriber databases

Privacy law assumes you can protect what you collect. The Federal Trade Commission treats weak security as a deceptive practice when your policy promises safeguards you do not have. The Data Security | Federal Trade Commission guidance covers reasonable safeguards for customer records, which includes subscriber lists.

Start with access control. Only the people who need the list should be able to export it. Use role-based permissions in your email service provider, require two-factor authentication, and remove access when a contractor leaves. Shared logins are the most common source of small-list leaks.

Encrypt data in transit and at rest. Most email service providers do this by default, but check. Keep a spreadsheet of subscribers outside the platform and you need that file encrypted on a managed drive with version history, not on a laptop desktop.

Vendor contracts matter. Your email service provider, payment processor and analytics tool should commit to reasonable security, notify you of breaches, and act on your deletion instructions. Keep a list of every vendor that touches subscriber data, with the contract date and the security contact.

Have a breach plan. If subscriber data is exposed, you need to know who to call, what to tell readers and which state agencies require notice. California and Colorado both have breach notification duties, and the clock starts when you discover the incident, not when you finish the investigation.

Train the people who touch the list. A short annual session on phishing, password managers and export rules prevents most incidents. Document the training so you can show it if a regulator asks.

Security protects revenue too. A leaked list damages sponsor trust and can end a partnership. Publishers who guard subscriber data tend to see steadier newsletter audience growth, because readers and advertisers both stay longer.

Building a privacy routine that survives staff changes

A routine beats a one-time cleanup. Put the tasks on a calendar and assign an owner, even if the owner is you. The goal is a repeatable process that outlasts a platform switch.

Compliance checklist

Track how these changes move the list. A cleaner consent record often improves deliverability, and your newsletter community engagement benchmarks will show whether readers respond better to a clearer policy.

Enforcement, penalties and where this is heading

The enforcement picture is real. The California Attorney General has pursued businesses over opt-out and deletion failures, and the Privacy and Data Security | State of California - Department of Justice - Office of the Attorney General page collects the office's guidance and actions.

Colorado's consumer protection section, described at Consumer Protection - Colorado Attorney General | Colorado Attorney General, handles CPA complaints alongside other deceptive practice cases.

Penalties differ by state. California can assess a civil penalty per violation, and a violation can count per affected consumer, which turns a small list into a large exposure. Colorado can seek penalties per violation under its consumer protection statute. Neither office needs a reader complaint to open a matter, though complaints are a common trigger.

More states are passing privacy laws, and our guide to newsletter content formats tracks how compliance duties are spreading across the country. A routine built for California and Colorado will need small edits, not a rebuild, when a new state joins.

None of this is legal advice. Sponsorship contracts, cross-border consent and the question of whether your list crosses a threshold are matters for a licensed attorney in your state.

Common questions

Does the CCPA apply to a small newsletter with 3,000 subscribers?

Usually not, unless you meet a revenue or data-volume threshold or earn half your revenue from selling personal information. Many small publishers comply anyway, because sponsors and payment processors ask for it.

Can I email a subscriber who asked me to delete their data?

No. Once you confirm deletion, stop contacting them. Keep a minimal suppression record with the address and date so you can prove you honored the request.

How long do I have to answer a deletion request?

Both California and Colorado give you 45 days, extendable by another 45 with notice. Answering within 30 days leaves room for verification problems.

Do I need consent to send a newsletter in Colorado?

The CPA governs personal data, not the email itself. CAN-SPAM sets the federal email rules. If you process sensitive data such as health or political interests, Colorado requires affirmative consent.