California GPC opts out of sale and sharing, not marketing email
Does Global Privacy Control require me to stop emailing Californians?
In one sentence
A browser signal is mainly “stop selling/sharing my data for ads,” not “delete me from the newsletter” by default.
Emailrules interpretation
(GPC) is a browser setting that means of sale or sharing of personal information under California rules. It is not automatically the same as unsubscribing from marketing email unless your privacy policy maps it that way. Honour GPC for ads/data sale; do not invent a full email ban the statute does not write.
Why it matters. Teams waste sprints wiring into Klaviyo suppressions that the law may not require — or they ignore GPC on the ad side where it does matter.
Dotted words open definitions. See how email actually works.
What to do
Your move — not a lecture
Part platform, part you
The platform covers the mechanical bit. The judgement is still yours.
platforms can detect in the browser. Propagation into the as "do not email" is not automatic and must be verified end to end.
Your part: Mapping what you actually sell/share, honouring the signal for those purposes, and not over-claiming email suppression.
What to do first
Ask privacy eng one question: when fires, what fields change in the within 24 hours? If the answer is "nothing," you have a sale/share gap—or you never sold/shared.
You can skip this if: You have no California consumers and no sale/share of personal information.
Who this applies to
Businesses subject to CCPA/CPRA that sell or share personal information, and any team told " means stop email."
Checklist
- 01Honour for sale and sharing as required; do not ignore the browser signal.
- 02Do not treat as a substitute for or / .
- 03If you voluntarily map to email suppression, document it as policy, not statute.
- 04Test the CMP → identity → path; do not assume magic.
That’s enough to act. The exact wording, the enforcement record and every primary source sit under Proof & sources, for counsel, bosses, or AI tools that need a citation. Not legal advice.
Proof
Exact position, enforcement, sources
For records and people who will check you. Skip if Monday’s move is already clear.
Source fact
Under California law, a valid preference signal such as (GPC) is a request to stop selling or sharing personal information, including sharing for cross-context behavioural advertising. It is not, by itself, a statutory command to suppress ordinary first-party marketing email. Businesses that sell or share must process the signal; businesses that do not may have less to do. Do not rebrand GPC as an email unsubscribe unless your own policy promises that.
What happens if you do not
California AG and CPPA enforce sale/share opt-outs; public actions have targeted dark patterns and non-honoured opt-outs. Misdescribing as mandatory email stop is a training error more than a statute.
Sources
- California Privacy Protection Agency, CCPA regulationsNo publisher dateRead primary source
- California Attorney General, CCPANo publisher dateRead primary source
History of this page
- Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
- Added to correct email-marketing overclaims about GPC.
Related
Take this with you
GET https://emailrules.today/rules/california-gpc-stops-sale-and-sharing-not-email?format=json
Same URL, same answer, every field including the ones behind the Proof tab. An Accept: application/json header on the plain URL does the same thing. All the endpoints.