Do state privacy laws apply to a B2B distributor or 3PL?

The short answer for distributors and 3PLs#

State privacy laws apply to a B2B distributor or 3PL when the company crosses a law's applicability thresholds and handles personal data the law does not exempt. Many B2B firms assume they sit outside these laws because they sell to businesses, but personal data turns up in more places than the customer list.

Look for it in the CRM, where buyer and purchasing agent contacts live; in HR and payroll systems; in driver telematics and camera systems; in call recordings and support inboxes; and, for 3PLs with e-commerce clients, in consumer names and ship-to addresses on every parcel order. Each of these can be treated differently depending on the state and the role the company plays.

Which thresholds decide whether a state law applies?#

State privacy law thresholds measure company size, the volume of residents' personal data processed, and how much of the business depends on selling personal data. A company usually needs to meet a threshold and do business in the state, or with its residents, before the law applies.

Each state sets its own figures and definitions, and they change. By MultiState's count, 20 states had comprehensive consumer privacy laws in effect once Indiana, Kentucky and Rhode Island's laws took effect on January 1, 2026, or 19 if Florida's narrower law is left out. Counsel should check the current text of each statute rather than a summary, and remember that thresholds are usually measured company-wide.

Employee and B2B carve-outs differ by state#

The biggest difference between states is how they treat employee and business-contact data. California's temporary exemptions for that data expired on January 1, 2023, when the legislature did not extend them, so a distributor that meets the CCPA thresholds may owe California employees and customer contacts core privacy rights.

Most other comprehensive state laws generally define a consumer in a way that excludes people acting in an employment or commercial context. Virginia's law is an early example, and the Colorado Attorney General states that the Colorado Privacy Act does not cover people acting in a commercial or employment context. Newer statutes should still be read one by one.

California's rules for workforce data are still developing: the California Privacy Protection Agency opened preliminary rulemaking on April 20, 2026 on how the CCPA applies to employee, applicant and contractor information. Carve-outs also narrow only the comprehensive laws. Biometric statutes, electronic monitoring notice laws in some states, and state breach notification laws can still apply to employee and driver data.

Business or service provider: the role question#

A distributor or 3PL's role decides what it may do with personal data, and the same company can hold different roles for different records. For its own employees, drivers and customer contacts, it decides why and how data is used, so it acts as the business or controller.

For consumer ship-to data processed for an e-commerce client, a 3PL usually acts as a service provider or processor. These laws generally expect a contract limiting that data to the client's business purpose. Using it for the 3PL's own purposes, including licensing it to an AI developer, would likely fall outside that role, so most licensing reviews exclude it.

The same split appears at distributors that drop-ship to consumers for retail customers, and at brokers whose shipment records carry residential delivery addresses. Tagging each record family with the role the company held when it collected the data is the simplest way to keep later decisions consistent.

What licensing data for AI training adds#

Licensing records for AI training adds questions that ordinary operations do not raise. Several state laws define sale and sharing broadly enough that a license of personal data for value could qualify, which brings opt-out rights and disclosure duties into play.

De-identified data is generally outside these laws, but the definitions come with conditions. California's definition, for example, requires reasonable measures so the data cannot be associated with a consumer or household, a public commitment to keep it in de-identified form and not attempt re-identification, and contracts that bind every recipient to the same terms. Other states use similar but not identical tests, so counsel should confirm the exact wording in each state that applies.

• 1Map which states' residents appear in each record family, including employees and contacts.
• 2Confirm the company's role for each record family: controller or service provider.
• 3Exclude client-owned consumer data processed as a service provider.
• 4Decide whether records will be de-identified to the standard each applicable law sets.
• 5Review the privacy policy and employee notices against the planned use.
• 6Check biometric, monitoring and sector rules for driver and camera data.
• 7Record the analysis so it can be shown to a buyer or acquirer later.

Illustrative: a distributor with a fulfillment arm narrows its scope#

Illustrative: a fictional industrial distributor runs Epicor for orders and inventory, Salesforce for its sales team, and a separate fulfillment division that ships to consumers for brand clients from its own WMS. Its inside sales and support staff work from several states, including California.

Before discussing a data license, the general counsel maps personal data by record family. Quote and order-exception histories on the distribution side contain buyer contact names and emails, which California's law covers. The fulfillment WMS holds consumer ship-to data processed for clients as a service provider.

The company scopes only distribution-side histories, removes contact names, emails and phone numbers during preparation, excludes all fulfillment consumer data and all HR records, and updates its privacy policy language with outside counsel. The analysis is filed with the deal records.

How SourceX approaches state privacy review#

SourceX treats state privacy law as a deal-by-deal assessment made with the supplier's counsel, not a box checked once. In the SourceX five-step transaction, the Rights and Preparation steps identify which record families contain personal data, which role the supplier holds for each, and which data must be excluded or de-identified.

The privacy record in the SourceX Evidence Packet documents what was removed, the standard applied and who approved release. No files are requested during the initial assessment, which runs on metadata only.