Is B2B contact data personal data under CCPA?

What changed for B2B data under the CCPA?#

The CCPA's treatment of B2B data changed on January 1, 2023, when the temporary exemption for business-to-business communications expired. The exemption was added in October 2019 through AB 25 with an original end date of January 1, 2021, and the California Privacy Rights Act later moved that date to January 1, 2023. The legislature ended its 2022 session without extending it. While it applied, information about contacts at customers, vendors and prospects sat outside most of the law's requirements. With the exemption gone, those contacts are generally treated like any other California consumer.

The temporary exemption for employee and job applicant information expired on the same date. The California Privacy Protection Agency opened preliminary rulemaking in April 2026 on how the CCPA applies to employee, applicant and contractor information, so watch for new rules on that side. For a software company, two record families shift at once: the CRM and support histories that describe customer contacts, and the Slack, email and HR records that describe staff.

Whether the CCPA applies at all depends on the company. It reaches for-profit businesses that do business in California and meet at least one threshold tied to annual revenue, the volume of California consumers' personal information handled, or the share of revenue earned from selling or sharing personal information. Secondary guides report the revenue threshold was adjusted to $26,625,000 effective January 2025, alongside thresholds of 100,000 or more consumers or households and 50% or more of revenue from selling or sharing personal information. The figures are inflation-adjusted, so confirm the current ones with counsel.

Which CRM and ticket fields count as personal information?#

CRM and ticket fields count as personal information when they identify, describe or can reasonably be linked to a particular person. A contact's name, work email and title clearly do. An account's industry or subscription tier usually does not, unless the account is a sole proprietor trading under their own name.

The table below covers the fields a B2B software company most often holds in Salesforce, HubSpot, Zendesk and Intercom. Free-text fields cause most surprises, because names and phone numbers end up in notes, signatures and quoted email chains.

Does licensing CRM records count as a sale under the CCPA?#

Licensing CRM records that still contain personal information may count as a sale under the CCPA, because the law defines selling broadly as making personal information available to another business for money or other valuable consideration. A license keeps ownership with the company, but the legal question turns on disclosure for value, not transfer of title.

If a license is a sale, the company generally faces notice, privacy policy and opt-out obligations, and an AI developer using records for its own models is usually a third party rather than a service provider. Opt-out requests the company has already received would also need to be honored. That is why most licensing programs remove personal information before delivery instead of managing opt-outs across years of contacts.

Why removing names is not the same as deidentification#

Removing names is not the same as deidentification under the CCPA, because the legal standard asks whether information can reasonably be linked back to a person, and it attaches conditions to how the company and its recipients handle the data. As commentators summarize Cal. Civ. Code 1798.140(m), the business must take reasonable measures so the information cannot be associated with a consumer or household, publicly commit to keep it deidentified and not attempt to reidentify it, and contractually bind recipients to the same terms. Counsel should check those conditions before any dataset is described as deidentified.

B2B records re-identify easily. A ticket saying the only controller at a family-owned freight broker could not close the month points to one person even with the name gone. Free-text fields, email threads and call transcripts carry most of this risk; structured fields are easier to clean.

• 1Remove direct identifiers: names, emails, phone numbers, user IDs and IP addresses.
• 2Generalize indirect identifiers: rare job titles, small company names and specific locations.
• 3Scan free text, signatures, attachments and quoted email chains, not only contact fields.
• 4Sample the output by hand and record what was found and fixed.
• 5Bind the recipient by contract not to attempt re-identification or onward disclosure.

How do other state privacy laws treat B2B contacts?#

Other state privacy laws treat B2B contacts differently from California. Several comprehensive state laws define a consumer in a way that excludes people acting in a commercial or employment context, so the same business contact may fall outside one law and inside another. Virginia's Consumer Data Protection Act, for example, generally does not apply to a person acting in a commercial or employment context, and that exclusion has no sunset. Newer state laws vary, so check each statute's definition of consumer.

CRM systems rarely record where a contact lives, and a work address says little about residence. The practical approach is to prepare records to the strictest standard that may apply and to review state differences with counsel for each deal, rather than filtering contacts by company address.

Illustrative: a CRM history review at a vertical SaaS company#

Illustrative: a fictional company selling scheduling software to commercial cleaning contractors wants to license its Salesforce opportunity history and Zendesk tickets. Its general counsel had assumed business contacts were exempt, based on advice the company received years earlier.

The review finds named contacts on every opportunity, call notes summarizing conversations with operations managers, and ticket threads full of email signatures. Counsel concludes that licensing the raw records would raise sale and notice questions. The company keeps deal stages, product issues and resolution steps, removes contacts, signatures and customer names, and has its privacy policy reviewed before any delivery.

How SourceX handles business contact data#

SourceX treats business contact details as personal information during the Preparation step of the SourceX five-step transaction and removes them from CRM, email and ticket records before anything reaches a buyer. The supplier approves the preparation rules and reviews samples of the output.

The SourceX Evidence Packet for each package includes the privacy record: which fields were removed or generalized, how free text was reviewed and which laws counsel considered. Nothing is shared during the initial fit check, which collects metadata only.