Privacy and preparation
Which state privacy laws exempt B2B contact data?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Most comprehensive US state privacy laws exempt B2B contact data by excluding people acting in a commercial context from the definition of consumer. California is the exception: its B2B exemption has expired, so business contacts who live there have full rights. The exemption follows the person's role in a record, not the record type or the company.
Key takeaways
- Outside California, a buyer, vendor rep or customer admin acting for an employer is generally not a consumer under comprehensive state laws.
- California business contacts are consumers, and a multi-state CRM rarely shows who lives where.
- The same person can be a business contact in one record and a consumer in another, such as a homeowner's service call.
- The exemption does not override confidentiality clauses, NDAs or data broker laws.
- Removing contact identities from licensed records costs little value, because buyers want the work, not the names.
How the commercial context exemption works#
The commercial context exemption works through the definition of consumer: most comprehensive state privacy laws cover residents acting in an individual or household context and exclude people acting in a commercial or employment context. A purchasing manager emailing your sales team on her employer's behalf is acting in a commercial context.
The exemption follows the role the person plays in a given record. It is not a carve-out for B2B companies, and it does not cover every field in a business record. The same purchasing manager who books a furnace repair through your residential division is a consumer for that job.
California is the main exception. Its temporary exemption for business-to-business personal information has expired, so contact details for California residents in your CRM are personal information under the CCPA, provided the CCPA applies to your company under its thresholds.
How common business records sort#
Common business records sort by the role of the person named, and the table shows typical outcomes for records a licensing project touches.
Rows can shift with each law's wording and with details such as a personal mobile number in a business signature. Counsel should confirm the treatment under the laws that may apply to you.
Operators see both sides of the line every day. A plumbing contractor's records mix homeowners, who are consumers, with property managers and general contractors acting for their companies, often in the same dispatch board. Sort by customer type before applying any exemption.
| Record | Person's role | Most other comprehensive state laws | California CCPA |
|---|---|---|---|
| CRM contact at a customer account | Acting for an employer | Generally exempt | Covered if a California resident |
| Support ticket from a customer's admin | Acting for an employer | Generally exempt | Covered if a California resident |
| Email thread with a supplier's sales rep | Acting for an employer | Generally exempt | Covered if a California resident |
| Residential service call for a homeowner | Individual or household | Covered | Covered |
| Sole proprietor buying for a one-person business | Can blur | Check the wording; often safer to treat as covered | Covered if a California resident |
| Purchased trade show lead | Acting for an employer, with no relationship to you | Generally outside the consumer definition, but may raise broker questions | Covered if a California resident |
What the exemption does not cover#
The exemption does not cover obligations that come from somewhere other than a state privacy law's consumer definition.
Read the customer's master agreement before licensing any correspondence with that customer's staff. Even with names removed, the content may be the customer's confidential information.
Treat the exemption as one input to the rights review, not its conclusion. It narrows which privacy law duties apply to a record; it does not decide whether the record is yours to license.
- Confidentiality clauses in customer and vendor contracts, which may restrict use of correspondence regardless of privacy law.
- Non-disclosure agreements signed during sales cycles or partnerships.
- Data broker laws, which can carry their own definitions.
- Breach notification laws, which protect certain identifiers in any context.
- Employee data, which falls under a separate exclusion with its own wording.
- Sensitive details, such as a health condition mentioned in a business email.
Handling California contacts in a multi-state CRM#
California contacts are hard to handle because a CRM rarely records where a business contact lives. Company addresses, area codes and office locations are poor proxies for residence, and remote work has made them worse.
The practical decision rule is simple: if you cannot reliably separate California residents, remove contact identities for everyone. Replace names with role labels, drop emails and phone numbers, and keep company size, industry and region if they are useful. Buyers want the sequence of questions, quotes and decisions, not the identity of the person who asked.
Record the rule and apply it to every record family, including email archives and call notes, not just the CRM. A rule that covers one system but not another leaves the same contact identifiable through a different door.
Why buyers rarely need business contact identities#
Buyers rarely need business contact identities because the value in operational records sits in the sequence of work: the question, the quote, the exception, the decision and the outcome. A model learns how a dispute over a damaged shipment gets resolved, not who the shipping manager was.
That makes contact removal one of the cheapest privacy decisions in a licensing project. The table shows the usual treatment for record families where business contacts appear most often.
Keep context that carries meaning without identifying anyone. Role labels, customer segment, company size band and region usually survive preparation and give the buyer what it needs to interpret each record.
| Record family | Where business contacts appear | Usual treatment |
|---|---|---|
| Quote and order histories | Requester names, buyer emails, approver names | Role labels; remove emails and phone numbers |
| Support tickets from business customers | Admin names, signatures, callback numbers | Role labels; strip signatures and numbers |
| Vendor and supplier correspondence | Rep names, direct lines, personal remarks | Role labels; review free text for personal remarks |
| Project correspondence such as RFIs and submittals | Client and consultant contacts | Role labels; remove client project names where confidential |
| Sales call notes | Prospect names, opinions about individuals | Remove names and comments about individuals, or exclude |
Illustrative: a freight brokerage reviews CRM and TMS records#
Illustrative: a fictional freight brokerage wants to license load histories, service exceptions and the shipper and carrier correspondence behind them, drawn from McLeod and HubSpot. Most of the people in those records are shipping managers and dispatchers acting for their employers.
Counsel notes that the commercial context exemption likely covers most contacts under the laws of several states where the brokerage operates, but that California contacts are covered and the CRM cannot reliably identify them. The brokerage replaces every contact name with a role label, removes emails, phone numbers and signatures, and excludes a purchased shipper list entirely.
The package keeps lanes, load events, exception notes and resolutions. The decision rule is documented once and applied across the whole archive.
How SourceX treats business contact data#
SourceX treats business contact details as personal information during the Preparation step of the SourceX five-step transaction, whatever exemption may apply, because one standard is easier to verify and buyers rarely need contact identities.
The Rights step separately reviews customer and vendor contracts for confidentiality limits, and both decisions are recorded in the SourceX Evidence Packet.
Frequently asked questions
Are job titles and company names personal information?
On their own, a job title or company name is usually not personal information, but together they can identify one person, such as the only procurement director at a small firm. Generalize titles to role families and consider removing company names for small customers.
Does the exemption cover email content, or only contact fields?
The exemption turns on the person's role, so it can extend to what a business contact writes in that role. Content often mentions other people, personal remarks or sensitive details, however, so review free text rather than relying on the exemption alone.
Must we honor deletion requests from California business contacts?
Generally yes, subject to the law's exceptions, since California business contacts are consumers. Records already licensed in deidentified form may fall outside a request, but counsel should review how requests interact with prepared packages and copies still held.
Does the exemption matter if we license to a buyer outside the US?
Cross-border licensing adds separate questions. A federal rule restricts some transfers of bulk sensitive personal data to countries of concern, and contracts may limit transfers. Business contact data that is fully deidentified generally raises fewer issues.
Is the exemption identical in every state outside California?
No. Most laws use similar commercial context wording, but definitions and exceptions differ, and some are amended in each legislative session. Check the wording of each law that may apply at the time of the deal, since any summary can lag behind amendments.
Are our vendors' staff covered the same way as our customers' staff?
Generally yes. A supplier's sales rep or a carrier's dispatcher writing to you on an employer's behalf is acting in a commercial context, so the same exemption logic applies outside California. Inside California, they are consumers like any other business contact.
Related resources
- QuestionCan CRM data be licensed?
- QuestionDo AI labs buy CRM data?
- InsightHow do I de-identify sales call recordings for AI training?
- InsightPurpose limitation: can records collected for one purpose be licensed for AI?
- InsightWhat is a consumer privacy ombudsman in bankruptcy?
- SolutionData partnerships between businesses and AI developers
See if your company qualifies
A short company assessment. No data uploads are needed.