Is B2B Contact Data Subject to the California Delete Act?

B2B commercial teams often assume that business data exists in a regulatory sanctuary. For years, revenue leaders treated corporate phone numbers, business email addresses, and employment titles as fundamentally distinct from consumer records.

That operational assumption is no longer safe.

On September 1, 2026, the California Privacy Protection Agency (CalPrivacy) announced an enforcement action against Virginia-based data vendor SalesIntel Research, Inc., as documented in the CalPrivacy announcement on the SalesIntel action. The agency penalized SalesIntel $36,400 for failing to register by the 2025 deadline under California's Delete Act.

The penalty itself was not triggered by the act of selling corporate contact records. Rather, it established that selling professional profiles, corporate phone lines, and career movement signals makes an organization a data broker under California law. For revenue leaders, revenue operations (RevOps) teams, and compliance officers, this distinction changes the due diligence required when purchasing, storing, and orchestrating third-party outbound lists.

Deconstructing the SalesIntel Enforcement Action

The regulatory action against SalesIntel highlights how state regulators define a modern commercial data broker. According to the CalPrivacy announcement on the SalesIntel action, SalesIntel marketed access to over 200 million professional contacts and 54 million mobile phone numbers, alongside features designed to de-anonymize website traffic to surface direct dials and verified work emails.

CalPrivacy did not rule that commercial prospecting is illegal. Instead, the enforcement focused on compliance with state transparency mandates. As detailed in the official stipulated order on SalesIntel, the case centered on SalesIntel's conduct in 2024 and its failure to register with the state registry by the statutory 2025 deadline. The order noted that the vendor registered in a timely manner in 2026 for its 2025 activity.

Beyond the $36,400 fine, the settlement required SalesIntel to:

• Post annual consumer rights metrics on its website.
• Integrate directly with the state's centralized deletion system.
• Process and honor all future deletion requests routed through that system.

This action followed other notable registry penalties. As reported by legal analysis from Clark Hill on the Delete Act and DROP, CalPrivacy issued a $42,000 fine against Datamasters and a $62,000 fine against S&P Global, Inc. for registration delays. In the S&P Global matter, the agency penalized an administrative oversight that left the entity unregistered for 313 days, demonstrating that intent does not shield organizations from statutory enforcement.

The Delete Act and the Mechanics of DROP

To evaluate vendor exposure, commercial teams must understand the statutory foundation: California Senate Bill 362 (SB 362), known as the Delete Act.

Under California Civil Code section 1798.99.80(c), as recorded in the California legislative code for data broker definitions, a data broker is defined as any business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.

Crucially, California law defines a "consumer" in California Civil Code section 1798.140(i) simply as a natural person who is a California resident, as cited in the California legislative code for consumer definitions. The statutory language includes no blanket carve-out for individuals acting in a professional or B2B context. While California previously maintained a temporary business-to-business communications exemption under Civil Code section 1798.145(n), the text of the statute confirms that this subdivision became inoperative on January 1, 2023, as verified in the California legislative code for CCPA exemptions.

[ California Resident ]
         │
         ▼
[ Submits Universal Deletion Request via DROP ]
         │
         ▼
[ Centralized CalPrivacy DROP Architecture ]
         │ (Mandatory retrieval every 45 days)
         ▼
[ Registered Data Broker Ecosystem ]
         │
         ├── Process deletion within 45 days
         ├── Cease selling or sharing consumer records
         └── Maintain permanent internal suppression list

The operational centerpiece of this regime is the Delete Request and Opt-out Platform (DROP). Under California Civil Code section 1798.99.86, which took effect on August 1, 2026, as documented in the California legislative code for the deletion mechanism, registered data brokers must access DROP at least once every 45 days. Once a broker receives a request, it must process the deletion within 45 days and permanently cease selling or sharing newly collected personal information regarding that consumer.

According to compliance guidance published by DataGrail on the Delete Act, failure to process deletion requests from DROP carries statutory penalties of $200 per request per day. This exposure operates independently from initial registration fines.

Enforcement standards around these filings are strict. On September 3, 2026, CalPrivacy published Enforcement Advisory No. 2026-01. The guidance explicitly stated that the Delete Act does not distinguish between unintentional clerical mistakes and intentional misrepresentation. An inaccurate registration entry triggers a $200 fine for each day the incorrect information remains in the registry.

Downstream Liability: Auditing Third-Party Prospecting Data

When a state regulator sanctions a data vendor, buyers often wonder: Does buying a lead list from a non-compliant broker expose my own company to fines?

Current enforcement notices focus on the entities that collect and sell records without direct consumer relationships, rather than ordinary buyers. However, downstream buyers face real operational and reputational fallout.

When a data provider updates its systems to comply with DROP mandates, it must purge registered California residents from its master databases. If your team imports static CSV exports or bulk contact databases, those records immediately begin decaying. If a contact has submitted a global deletion request via DROP, continuing to target their personal mobile number or private inbox creates compliance friction, risks carrier spam blacklisting, and increases the likelihood of individual complaints.

Teams operating outbound telephone campaigns must also maintain separate safeguards, such as managing TCPA consent revocation in B2B outbound sales, because federal telemarketing rules operate independently of state data broker registries.

To protect internal systems, RevOps leaders should implement a four-step audit for third-party prospecting data:

1. Verify Vendor Registry Status

Before signing or renewing an agreement with a commercial data provider, inspect the public California Data Broker Registry. Confirm that the vendor is actively registered for the current calendar year. If an offshore or domestic provider sells direct dials or personal emails of US professionals but claims exemption, demand their legal basis in writing.

2. Audit Sourcing and Enrichment Workflows

Ask vendors how their contact details are sourced. Do direct dials come from opt-in business cards, public regulatory filings, automated web scraping, or mobile application SDK trackers? Under California Senate Bill 361 (SB 361), brokers must disclose whether they collect mobile advertising IDs, login credentials, or sell data to AI training pipelines. Knowing the provenance of your enrichment stream reveals whether a partner is susceptible to sudden service disruptions.

3. Establish Synchronization Windows

If your provider removes records to comply with DROP, your internal Customer Relationship Management (CRM) platform should not preserve stale, disputed records indefinitely. Establish a policy with your vendors to receive regular suppression list updates. When evaluating outbound platforms, as detailed in our analysis of Lemlist vs Ember Lead Intelligence: Outbound Comparison, teams should consider how their pipeline software handles contact updates, opt-outs, and lead exclusions over time.

4. Separate Static Scrapes from Verified Research

Mass scraping yields high decay rates and elevated compliance liabilities. Sustainable outbound operations rely on multi-signal verification: confirming that the organization has a live business need, that the contact's professional position is current, and that outreach occurs on verified professional channels.

Operationalizing Compliant Outbound

Managing regulatory exposure does not mean abandoning outbound acquisition. Incumbent enterprise platforms and traditional data providers remain suitable options for teams that require millions of raw, static contact lines for wide-scale outbound operations across regions unaffected by strict registry rules.

However, modern revenue teams increasingly avoid massive, unverified cold lists in favor of contextual intelligence. Instead of buying millions of static rows, outbound engines can prioritize timing, role relevance, and observed business signals.

For teams building this workflow, Ember Lead Intelligence organizes prospecting around qualitative signals rather than static volume. By helping commercial teams identify who to contact, why the timing makes sense, and which strategic angle to use, Ember shifts outbound away from undifferentiated mass scraping and toward contextual outreach.

Within Ember, prospecting missions operate under clear operational boundaries: every draft email or LinkedIn message requires human review and explicit scheduling before delivery, and the platform enforces an immediate do-not-contact mechanism that halts pending cadences across linked mailboxes and profiles whenever a prospect opts out. For teams scaling their revenue architecture, exploring the Knowledge guides for sales provides practical frameworks for building an acquisition engine that balances outbound velocity with defensible data governance.