When a Cold Prospect Asks You to Delete Their Data

"Unsubscribe me" and "delete everything you have on me" are different requests. Most agency playbooks handle the first well. The second often lands in a shared inbox, gets marked as a negative reply, and nobody does anything else.

For California prospects, that can be a problem. Since January 1, 2023, the California Consumer Privacy Act has covered business contacts too. This post explains what changed, who has to act, and a handling process an agency can run per client.

This is not legal advice. Each client should confirm with their own counsel whether and how the CCPA applies to them.

B2B contacts are covered now

The original CCPA had a temporary exemption for personal information collected in a business-to-business context. That exemption expired on January 1, 2023 and was not extended. As law firms summarized at the time, covered businesses now have to give California business contacts the same rights as other California residents, including the right to request deletion.

So a VP of Operations in California who received a cold email from your client is, for CCPA purposes, a consumer with rights over the data your client holds about them, if your client is a business covered by the CCPA.

What a deletion request requires

Under California Civil Code section 1798.105, a business that receives a verifiable request to delete must:

• delete the consumer's personal information from its records,
• notify its service providers and contractors to delete it, and
• notify third parties to whom it sold or shared the information, unless that proves impossible or involves disproportionate effort.

Section 1798.130 sets the clock: respond within 45 days of receiving the request. The business can extend once by another 45 days "when reasonably necessary," but only if it tells the consumer within the first 45 days. The statute also lists exceptions to deletion, such as complying with a legal obligation.

One wording detail is worth raising with counsel. Section 1798.105(a) describes the right to delete information the business "has collected from the consumer." Much cold-outreach data comes from vendors, not from the prospect. How that wording applies to purchased contact data is a legal question, and the operationally simple answer is to treat every deletion request as real and let counsel decide the edge cases.

Who acts: the client or the agency

In most agency setups, the client is the business and the agency processes data on its behalf. The statute expects service providers and contractors to cooperate with the business in handling deletion requests, and it does not require them to act on a request sent directly to them in that role.

In practice, that means the agency's job is to:

1. recognize the request,
2. route it to the client quickly, with the date received, and
3. carry out the deletion in the client's workspace when the client confirms.

Agree on this in writing at onboarding. "Who owns privacy requests, and how fast do we hand them over" is a two-line clause that saves a scramble later.

A handling process per client

1. Tag deletion requests separately from unsubscribes. Train whoever triages replies to spot phrases like "delete my data," "remove my information," or a mention of CCPA or privacy rights. These should not sit in the "not interested" pile.
2. Stop all outreach at once. Whatever the deletion outcome, the person should get no more steps, on any channel, from that client.
3. Forward to the client's privacy contact the same day. Include the original message and the date it arrived. The 45-day clock starts on receipt.
4. Find every copy. The contact can live in the sending tool, the CRM, enrichment exports, spreadsheets, and a vendor's list. Field-level provenance makes this much easier: if you know where each field came from, you know which vendors to notify.
5. Ask the client how to keep the do-not-contact record. Deleting someone completely means they could be re-imported next quarter from a vendor list. Have counsel decide how to keep a minimal record that prevents re-contact.
6. Confirm and log. Record when the request arrived, when it went to the client, and when deletion finished.

Related, but different: DROP

California's Delete Request and Opt-out Platform (DROP) lets residents send one deletion request to all registered data brokers. That reaches the vendors your lists come from. We covered it in California's DROP and client prospect lists. A direct request from a prospect is a separate obligation on the business that holds the data.

Where GTM fits

GTM keeps provenance on every field, anchors retention to the collection date, and keeps suppression in place even after a purge, inside each client's isolated workspace. That is the groundwork for finding every copy of a contact and making sure a deleted person does not come back. GTM's CCPA controls are still being verified, so the client's own privacy process stays the source of truth.

If you run outbound for several clients and want this kind of data trail per client, join the waitlist.

Sources

• California Civil Code §1798.105: https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.105
• California Civil Code §1798.130: http://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.130.
• Morgan Lewis, "California Consumer Privacy Act: Employee and B2B Exemptions Expire January 1, 2023": https://www.morganlewis.com/pubs/2022/10/california-consumer-privacy-act-employee-and-b2b-exemptions-expire-january-1-2023
• Freshfields, "Expiration of the CCPA Exemptions for HR Data and B2B Data": https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/california-employers-and-b2b-companies-heres-a-sunset-youll-want-to-look-out-f-102hy41