Twenty U.S. states now enforce comprehensive consumer privacy legislation. There is no federal preemption coming. If you run outbound into the U.S., you are complying with the strictest state law that touches your prospect, not the one where your company is registered.
That sounds like a legal problem. It is mostly an operational one. And California already solved most of it for you.
There is no federal floor, so the strictest state wins by default
Here is the shape of it. Virginia passed a law in 2023. Colorado, Connecticut, Utah followed. Then Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, and a dozen more. Each one has slightly different definitions of "sale," different opt-out mechanics, different cure periods, different thresholds for who counts as a covered business.
No federal bill has preempted any of it. Congress has been trying since 2019. It is not close.
So the practical rule for a founder running outbound is this: you comply with the strictest applicable law, because you cannot reliably segment your list by state before you send. A prospect's billing address is not their legal residence. A prospect's LinkedIn location is not their legal residence. You will get this wrong if you try to be clever about it.
The good news is that the strictest applicable law is almost always California's. CCPA, as amended by CPRA, is the broadest, the most enforced, and the one every other state legislature copied from. Align with California and you clear the bar in the other nineteen.
What California actually requires from a cold email operation
CCPA and CPRA do not ban cold email. They regulate personal information. If you are storing a prospect's name, work email, company, and title in a CRM, you are processing personal information under the statute.
Three obligations matter for outbound:
- Notice at collection. When you collect personal information, you have to tell the person what you are collecting and why. For outbound, this is usually satisfied by a clear privacy policy linked in your email footer and on your site.
- Right to know and right to delete. If a prospect asks what you have on them, or asks you to delete it, you have 45 days to respond. This is the one that catches small teams out, because the data is often spread across a CRM, an enrichment tool, and a sequencer.
- Right to opt out of sale or sharing. If you are passing prospect data to a third-party enrichment vendor or a data broker, that can count as a sale. You need a mechanism for prospects to opt out.
None of this is exotic. Most of it is a privacy policy, a suppression list, and a documented process for handling deletion requests. The failure mode is not the law. It is that nobody on a three-person team owns it.
The B2B exemption is narrower than people think
There is a persistent belief that B2B contact data is exempt from state privacy laws. That was true in some early drafts. It is not true now.
California removed the B2B exemption when CPRA took effect in 2023. Colorado, Connecticut, and Virginia have limited B2B carve-outs, but they apply to the business as a consumer, not to the individual employee whose data you are processing. If you are emailing a named person at a named company, that person has rights under most of these statutes.
We have seen founders assume that because they only email work addresses, they are outside scope. They are not. The work email is still personal information when it is tied to an identifiable human.
What this means in practice: your suppression list has to work across every tool that touches prospect data. If someone opts out in your sequencer but stays in your enrichment tool, you have a problem the next time you build a list.
What we changed in our own outbound stack
We run outbound. We had to make this concrete. Here is what we did, and what we would tell a customer to do.
First, we treat California as the baseline. Every prospect record gets the same treatment regardless of state. No segmentation by jurisdiction, because segmentation by jurisdiction is where errors live.
Second, we keep one suppression list and we sync it everywhere. Sequencer, CRM, enrichment tool. If a prospect opts out, they are out of all three within 24 hours. This is the single highest-value operational change we made.
Third, we log deletion requests. Not because anyone audits us, but because if a request comes in and we cannot find the data, we need to know that before we respond, not after.
Fourth, we stopped buying lists. This is the one that hurts. Purchased lists are the hardest thing to comply with, because you cannot tell a prospect where their data came from or who else has it. If you are running outbound on a bought list, you are carrying compliance risk you cannot quantify.
We wrote about the broader pattern of prospect list liability after the July 2026 compliance fines. The short version: the list is the liability, not the email.
What this does not require
You do not need a data protection officer. You do not need a consent management platform. You do not need to stop cold emailing.
You do need a privacy policy that actually describes what you collect. You need a working opt-out. You need to be able to delete a record on request. And you need to know which vendors touch your prospect data, because you are responsible for them.
If you are a solo founder running 200 emails a week, this is an afternoon of setup and a monthly check. If you are a five-person team running 5,000 emails a week across three tools, it is a process you have to own.
The states are not going to stop passing legislation. The federal government is not going to preempt it. The only question is whether you build the compliance layer now, while it is cheap, or after a complaint.
What we would do next
Pick California as your standard. Write the privacy policy. Build the suppression sync. Then get back to sending.
If you want to see how MiraReach handles suppression lists and prospect data across the outbound workflow, give MiraReach a try. We built it so the compliance layer is not a separate project.
— Mira