Ask a security team what PII is and you’ll hear the classics: names, SSNs, card numbers. California’s CCPA looked at that list and said: too narrow. Browsing history? Personal information. Household data? Personal information. The PROFILE your algorithm inferred? Also personal information.
📌 TL;DR: CCPA 'personal information' = anything that identifies, relates to, or could reasonably be linked with a consumer or household: identifiers, commercial records, browsing behavior, geolocation, and inferences drawn from all of it. It's far broader than classic PII, with real consumer rights attached.
What Is PII Under CCPA?
Under the California Consumer Privacy Act, ‘personal information’ is any information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The operative phrase is ‘reasonably linkable’. Data doesn’t need a name attached to qualify. It just needs a plausible path back to a person.
What the definition sweeps in
- Identifiers: names, emails, IP addresses, device IDs, account handles
- Commercial and behavioral data: purchases, browsing history, app interactions
- Geolocation, biometrics, employment and education data
- Inferences: the profiles and predictions DERIVED from the above. Your model’s output about a person is personal information too
- Household data: information about a household counts even without singling out one member
What it means in practice
Rights attach to all of it. California consumers can demand to know what’s collected, have it deleted, and opt out of its sale or sharing. So businesses must be able to FIND every record linked to a person, across every system. That’s a data-architecture demand disguised as a legal one. Fulfilling one deletion request takes the kind of unified customer view that master data management exists to build.
Two boundaries are worth knowing. Properly de-identified or aggregated data sits outside the definition. But the bar is high, and reversible pseudonymization doesn’t clear it. And the early B2B exemptions have since sunset. Business-card data about a person at a company is personal information under CCPA today. US teams doing B2B outreach should plan accordingly.
The rights, and the machinery they demand
CCPA (as amended by the CPRA) attaches operational rights to its broad definition. And each right is secretly an engineering requirement.
Right to know: consumers may request everything collected about them. That demands the ability to FIND every record for a person across every system: a matching and inventory problem before it’s a legal one. Right to delete: removal across systems, backups policy included, with exceptions documented. Right to correct: inaccurate personal information fixed on request. Right to opt out of sale/sharing: including the ad-tech definition of ‘sharing’, with the Global Privacy Control browser signal honored automatically. Sensitive-category limits: a defined subset (precise geolocation, health, credentials) with use-limitation rights on top.
See the pattern? Fulfillment presumes a unified view of the person: the master-data problem wearing a statute. Companies discover their duplicate and siloed records as compliance findings.
What compliance actually looks like day to day
- Data inventory and mapping: knowing what personal information lives where, flowing through which processors. The living document every request handler consults
- Request intake and identity verification: verifying the requester IS the consumer without collecting yet more data. The 45-day clock starts at receipt
- Vendor contract flow-down: service-provider agreements restricting processing purposes. Your processors’ behavior is your liability
- Retention discipline: declared purposes with declared lifetimes. Indefinite hoarding is now a documented violation, aligning privacy law with lifecycle management practice
- Notice accuracy: the privacy policy as a maintained, true description of practice, not aspirational boilerplate. Enforcement actions read them literally
The B2B practitioner’s view
For B2B data work, the load-bearing fact is the sunset of the early exemptions. Business contacts are consumers now. A prospect database of California professionals carries know/delete/opt-out obligations like any consumer list. So B2B enrichment, prospecting, and CRM operations need the same request machinery, suppression hygiene, and provenance records as consumer marketing.
The practical posture has three parts. Source data from providers who can document collection and legal basis. Honor suppression permanently, because a deletion that resurrects on the next enrichment sync is a violation with a timestamp. And treat California’s framework as the floor other states are actively copying. Designing to it once beats retrofitting per statute.
CCPA in the American privacy patchwork
California moved first. But the map filled in fast. A growing roster of states now runs privacy laws sharing CCPA’s DNA (broad personal-information definitions, consumer rights, opt-outs) with variations in thresholds, sensitive-data handling, and enforcement.
For multi-state operations, the practical response is designing to the strictest common denominator. One request-handling process. One suppression regime. One inventory. That satisfies the family, not each statute separately.
And the federal question remains perennially open. So the state patchwork is the operating reality for the foreseeable future. Which makes ‘design once, comply broadly’ the only sane engineering posture.
Real-World Examples
California’s first CCPA enforcement action shows where regulators look. A large retailer’s “Do Not Sell” link worked for people who clicked it. But the site ignored the Global Privacy Control signal that browsers send automatically, and third-party trackers kept sharing data. That gap cost a seven-figure settlement. The lesson: honoring opt-outs means every opt-out channel, including the automated one.
Data brokers learned a parallel lesson. California now requires them to register publicly and honor deletion at scale. So a business built on reselling personal information carries standing legal duties, not just contractual ones.
And the B2B example hits closest to home. Picture a sales team that deletes a California contact on request. Three weeks later, the nightly enrichment sync re-adds the same person from a vendor feed. That resurrected record is a documented violation. It’s exactly why suppression lists must sit between your data sources and your CRM, permanently.
Common Mistakes
CCPA programs fail in patterns. So check your own against these.
- Scoping PI as name-and-SSN: the reasonably linkable test sweeps in device IDs, browsing history, and household data. A classic PII checklist misses most of what the statute covers
- Forgetting inferences: the scores and segments your systems derive count as personal information too. Deletion requests reach them, and most pipelines can’t
- Verifying identity by over-collecting: demanding a photo ID to process a simple deletion creates new personal information while handling old. Match verification depth to request risk
- Aspirational privacy policies: enforcement reads your notice literally. If practice and policy differ, the policy becomes evidence, not protection
- One-time suppression: honoring a deletion once and letting a sync undo it. Suppression is a standing filter, not a task you finish
Because the consumer rights are operational, every one of these mistakes eventually surfaces as a mishandled request. And requests come with deadlines.
Frequently Asked Questions
What counts as PII under CCPA?
Any information that identifies, relates to, or could reasonably be linked with a consumer or household, from emails and IP addresses to purchase history and inferred profiles. ‘Reasonably linkable’ is the test, not ‘has a name on it’.
Is B2B contact data personal information under CCPA?
Yes. The early B2B exemptions expired, so business contacts’ details are personal information with consumer rights attached. B2B outreach data in California scope needs the same handling discipline as consumer data.
What is the difference between PII and personal information under CCPA?
Traditional PII lists specific identifying fields; CCPA’s ‘personal information’ covers anything reasonably linkable to a person or household, including behavior and inferences. The CCPA definition is deliberately, dramatically broader.
What rights does the CCPA give consumers?
To know what’s collected, delete it, correct it, opt out of sale and sharing, and limit sensitive-data use, each within statutory deadlines. Fulfilling any of them presumes finding every record for a person across systems: a data-architecture capability wearing a legal name.
How does CCPA affect B2B prospecting?
Directly, since the B2B exemptions sunset: California business contacts carry full consumer rights, so prospect databases need request handling, permanent suppression, and documented provenance. Enrichment flows that resurrect deleted contacts are the classic violation pattern.