The CCPA (2018) grants California consumers broad privacy rights over their personal information, including the right to access, delete, and opt-out of the sale of their data, while the CPRA (2020) expands these rights and establishes the California Privacy Protection Agency (CPPA). The CPRA went into full effect January 1, 2023, and it is enforced by the CPPA starting July 1, 2023. Businesses must be transparent about their data practices and provide consumers with control over their data.

The TCPA (1991) restricts telephone solicitations and the use of automated telephone equipment. It requires businesses to obtain prior express written consent before contacting consumers via phone, text, or fax for marketing purposes. The FCC enforces TCPA regulations and has issued numerous rulings clarifying its scope and application to emerging technologies like SMS marketing and AI-driven communications. Businesses must maintain records of consent and provide opt-out mechanisms to comply with TCPA rules. Penalties for non-compliance can be severe, including fines and legal action.

The CAN-SPAM Act (2003) sets rules for commercial email and requires businesses to provide recipients with the right to opt-out of receiving future emails. It prohibits deceptive subject lines and requires senders to include a valid physical postal address. The FTC enforces the CAN-SPAM Act, and businesses that violate its provisions may be subject to significant penalties. Compliance includes honoring opt-out requests promptly, monitoring email marketing campaigns for compliance, and training employees on CAN-SPAM requirements. The penalty for each email in violation of the CAN-SPAM Act is up to $51,744; and the law allows more than one person to be held responsible for violations.