emailrules.today
In forceLegalIn force 1 Jan 2023

California GPC opts out of sale and sharing, not marketing email

Does Global Privacy Control require me to stop emailing Californians?

California · United States

In one sentence

A browser signal is mainly “stop selling/sharing my data for ads,” not “delete me from the newsletter” by default.

Plain English

(GPC) is a browser setting that means of sale or sharing of personal information under California rules. It is not automatically the same as unsubscribing from marketing email unless your privacy policy maps it that way. Honour GPC for ads/data sale; do not invent a full email ban the statute does not write.

Why it matters. Teams waste sprints wiring into Klaviyo suppressions that the law may not require — or they ignore GPC on the ad side where it does matter.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

platforms can detect in the browser. Propagation into the as "do not email" is not automatic and must be verified end to end.

Your part: Mapping what you actually sell/share, honouring the signal for those purposes, and not over-claiming email suppression.

What to do first

Ask privacy eng one question: when fires, what fields change in the within 24 hours? If the answer is "nothing," you have a sale/share gap—or you never sold/shared.

You can skip this if: You have no California consumers and no sale/share of personal information.

Who this applies to

Businesses subject to CCPA/CPRA that sell or share personal information, and any team told " means stop email."

Checklist

  • 01Honour for sale and sharing as required; do not ignore the browser signal.
  • 02Do not treat as a substitute for or / .
  • 03If you voluntarily map to email suppression, document it as policy, not statute.
  • 04Test the CMP → identity → path; do not assume magic.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

Under California law, a valid preference signal such as (GPC) is a request to stop selling or sharing personal information, including sharing for cross-context behavioural advertising. It is not, by itself, a statutory command to suppress ordinary first-party marketing email. Businesses that sell or share must process the signal; businesses that do not may have less to do. Do not rebrand GPC as an email unsubscribe unless your own policy promises that.

What happens if you do not

California AG and CPPA enforce sale/share opt-outs; public actions have targeted dark patterns and non-honoured opt-outs. Misdescribing as mandatory email stop is a training error more than a statute.

Sources

Related

History of this page

  • Added to correct email-marketing overclaims about GPC.

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.