B2B website visitor identification in California

Yes, and this is the fact that separates California from most other US states with comprehensive privacy laws. The original CCPA included a temporary exemption for personal information collected in a business-to-business context, alongside a separate temporary exemption for employee and job-applicant data. Both were extended year over year by the legislature, but neither was renewed again after 1 January 2023, so both exemptions expired on that date. Since then, a business contact's name, work email address, job title or business phone number collected through a B2B interaction is personal information under the CCPA/CPRA on the same footing as a consumer's data, subject to the same access, deletion, correction and opt-out rights. Businesses operating in California, or receiving traffic from California, that assumed B2B data was automatically outside scope should revisit that assumption, ideally with counsel, since it has not been accurate for several years.

The CCPA/CPRA defines 'sale' around disclosure for money or other valuable consideration, and 'sharing' around disclosure for cross-context behavioural advertising specifically, and both definitions describe a different data flow than company-level identification. lead.box resolves the organisation behind a website visit from network-level signals such as IP address ranges, without identifying a named individual, and does not transmit that information to advertising networks or use it to build cross-site advertising profiles. That means the activity does not match the fact pattern either definition is built to reach, but confirming this against your own specific implementation and your own privacy notice remains the business's responsibility under California law, since the statute's definitions and CPPA guidance continue to develop and a general description like this one cannot substitute for that review.

Global Privacy Control (GPC) is a browser or extension-level signal that a California consumer can enable once, which the CCPA/CPRA treats as a valid, standing request to opt out of the sale or sharing of personal information, without the consumer needing to submit a separate opt-out form on every site they visit. Sites subject to the CCPA/CPRA are expected to detect and honour that signal. Because lead.box does not sell or share personal information for cross-context behavioural advertising in the first place, its company-level identification activity is not the kind of processing GPC is designed to stop, but a business layering other tools with genuine sale or sharing activity onto the same site still needs its own GPC handling for those other tools, independent of how lead.box operates.

Enforcement is shared between two bodies, which is unusual among US privacy statutes. The California Privacy Protection Agency (CPPA), created specifically by the CPRA, writes implementing regulations and can bring its own enforcement actions, including administrative proceedings. The California Attorney General retains separate, independent authority to enforce the statute as well, so a business can in principle face scrutiny from either body. There is no general statutory cure period for most current violations, unlike some other state privacy laws in this cluster that give a business a defined window to fix a documented issue before penalties apply. That makes accurate, specific documentation of what a visitor identification tool does — and does not do — a more immediate priority for a California-facing business than for one operating only in states with a standing cure period.

The CCPA/CPRA gives California consumers rights including access, deletion, correction and opt-out of sale or sharing, and since the B2B exemption expired those rights extend to business contacts too. Because lead.box does not sell or share personal information as those terms are defined by the statute, and does not link resolved company data to a named individual's profile, the specific opt-out-of-sale-or-sharing mechanism is not the operative right for this activity. A business running lead.box on a California-facing site should still maintain a general privacy notice describing this processing and a route for a visitor to raise a request, since the broader set of CCPA/CPRA rights and the business's own disclosure obligations exist independently of whether any single vendor's activity meets the definition of a sale or sharing.

The CCPA/CPRA's rights and obligations attach to personal information reasonably linkable to an identified or identifiable natural person or household. lead.box resolves which organisation is visiting a site — a company name, industry and size band, inferred from network-level signals such as IP address ranges — without identifying which specific employee is browsing, and without producing a list of named contacts, job titles or personal email addresses. That is a materially different output than a tool that identifies an individual visitor, and it is the reason company-level identification raises a different set of questions under California law than, say, a form-fill or an email-append service would. The distinction is worth stating explicitly in your own privacy documentation rather than assumed, since 'B2B' and 'company-level, not individual-level' are two separate scope questions under the statute, not one.

Expect a California-facing review to ask, at minimum, whether the tool sells or shares personal information as those terms are statutorily defined, how it handles the Global Privacy Control signal, whether any sensitive personal information is collected, and what documentation exists to support those answers, such as a data processing agreement and a sub-processor list. lead.box provides that documentation set on request, describing the mechanism plainly enough for a privacy team to check it against the CCPA/CPRA's current text and any applicable CPPA regulations. Because the statute and its implementing regulations continue to evolve, and because this description is written for general orientation rather than as a compliance opinion, a business should have its own counsel confirm the current requirements before finalising an approval, rather than relying solely on a vendor's own summary.

No. This page explains, at a general level, how the CCPA/CPRA's scope, its 'sale' and 'sharing' definitions, and its enforcement structure relate to company-level visitor identification, and it is not a substitute for legal advice about your specific business, your specific data flows, or your specific California traffic. lead.box acts as a processor under a data processing agreement and can provide documentation describing what the product does and does not collect, but it does not and cannot issue a compliance opinion binding on a customer's own use of the tool alongside its other systems, disclosures and vendors. Given the joint CPPA and Attorney General enforcement structure and the absence of a general cure period, a business should have qualified counsel review its complete data practices, including but not limited to its use of lead.box, before relying on any vendor's description as sufficient on its own.