Which US State Privacy Laws Cover B2B Prospects? Mostly Just California
Agencies running outbound for US clients get the same question in onboarding calls: "Do the new state privacy laws apply to our prospect lists?" There are now more than twenty comprehensive state privacy laws on the books, and the list keeps growing, so the worry is fair.
The short answer is narrower than most people expect. For people you contact in their work role, California is the outlier. Nearly every other comprehensive state law defines its protected "consumer" in a way that leaves business contacts out. That doesn't make the rest of the country a free-for-all, and the exclusion has edges worth knowing. This guide covers what the laws say, where the line sits, and what an agency should still do.
This is a plain-language summary, not legal advice. Clients with real exposure should talk to their own counsel.
The definition that does most of the work
These laws protect "consumers," and the definition of consumer decides who's in scope.
Texas is a good example, since its law has been in effect since July 1, 2024. The Texas Data Privacy and Security Act defines a consumer as "an individual who is a resident of this state acting only in an individual or household context," and then adds: "The term does not include an individual acting in a commercial or employment context."
Virginia uses nearly the same words. Its Consumer Data Protection Act defines a consumer as "a natural person who is a resident of the Commonwealth acting only in an individual or household context," and says "it does not include a natural person acting in a commercial or employment context."
That pattern repeats. Mayer Brown's state privacy law tracker, current as of September 3, 2026, lists 24 comprehensive state laws. In its exemptions table, California is the only state marked as applying to people "engaged in commercial or employment context (B2B and HR)." Every other state on the list, from Virginia and Colorado to Indiana, Kentucky, and Rhode Island (all effective January 1, 2026), is marked as not applying to them.
California is different, and has been since 2023
California's law originally had a temporary carve-out for business-to-business data too. It's gone. The California Attorney General's CCPA page says the exemptions for "personal information reflecting business-to-business transactions" in Civil Code section 1798.145 "expired on December 31, 2022."
So a VP of Operations who lives in California has CCPA rights over the data a covered business holds about them, including the right to know, delete, correct, and opt out of sale or sharing. The AG's page notes that only California residents have these rights, and that a California resident is "a natural person ... who resides in California, even if the person is temporarily outside of the state."
The CCPA also only applies to businesses that meet its thresholds, which include an annual revenue test and a test based on how much California residents' data the business buys, sells, or shares. Your client may or may not qualify. That's one of the questions to settle in onboarding, not to guess at.
We covered the deletion side of California in an earlier post on prospect deletion requests. The point here is the map: one state treats your prospects as consumers, and the others mostly don't.
Where the exclusion stops
"Commercial or employment context" describes how the person is acting, not what kind of person they are. That's the part agencies should take seriously.
A procurement lead emailed at their work address, about a product their company might buy, is acting in a commercial context. That's the core B2B outbound case, and it's what the exclusion was written for.
The picture changes when the data starts doing consumer things. Two examples to watch for:
- Personal contact data in the record. If an enrichment tool adds a personal email address or personal phone number, and the campaign uses it, the contact is no longer clearly in a work context.
- Using business lists for consumer-style ad targeting. Matching a prospect list to personal social profiles for retargeting is a different activity from sending a work email about a work purchase.
The statutes don't list these scenarios one by one. They give a definition, and the definition turns on context. Our read is simple. Keep outbound in the work context, with work addresses, about work purchases, and you stay on the side of the line the laws describe.
What still applies everywhere
The state exclusion isn't the only rule in play. Three others don't care which state the prospect lives in.
CAN-SPAM is federal and covers B2B. The FTC's compliance guide says the law "makes no exception for business-to-business email." Commercial email needs accurate headers, a non-deceptive subject line, a physical postal address, and a working opt-out honored within 10 business days. The FTC lists penalties of up to $53,088 per violating email.
Mailbox provider rules apply to every sender. Google and Yahoo set authentication, complaint-rate, and unsubscribe expectations that have nothing to do with state law. Breaking them hurts the client's domain, whatever the legal analysis says.
California residents are spread across every list. A national list for a US client will almost certainly include California-based contacts. Unless the client is sure it falls outside the CCPA's thresholds, plan for California rights requests on any multi-state campaign.
A practical setup per client
Here's how we'd turn this into something an agency can run without a lawyer on every campaign.
- Ask the CCPA threshold question at onboarding. Record the client's answer and who gave it. If they're covered, California rights requests are in scope for their prospects.
- Keep the work-context line in the data. Use work email addresses and work phone numbers for outbound. Strip or quarantine personal contact fields that enrichment adds.
- Track prospect state where you have it. You don't need it for every send, but you need it when someone writes back asking what you hold about them.
- Handle every "delete my data" or "what do you have on me" reply the same way. Even outside California, honoring it costs little and avoids a judgment call under pressure. Suppress the person so they never return in a later import.
- Recheck when the map changes. New state laws keep coming into effect. Oklahoma and Louisiana take effect January 1, 2027, Alabama May 1, 2027, and Vermont January 1, 2028, according to the same tracker. Read each new law's consumer definition when it lands. Don't assume it matches the others.
Where GTM fits
GTM keeps every client in an isolated workspace. Each field carries its source, retention is anchored to the date the data was collected, and suppression survives purges, so a deletion or opt-out from one prospect stays applied in that client's workspace. GTM is US-only today, with GDPR built into the data model and CCPA controls still being verified.
If you run outbound for several US clients and want prospect data handled per client, join the waitlist.
Sources
- Texas Business and Commerce Code, Chapter 541 (Texas Data Privacy and Security Act), section 541.001: https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm
- Code of Virginia, section 59.1-575, Definitions: https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-575/
- Mayer Brown, "State Privacy Law Tracker" (current as of September 3, 2026): https://www.mayerbrown.com/en/insights/resource-centers/cybersecurity-and-data-privacy-resource-center/state-privacy-law-tracker
- California Department of Justice, "California Consumer Privacy Act (CCPA)" (updated August 28, 2026): https://oag.ca.gov/privacy/ccpa
- Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business": https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business