What State Privacy Laws Actually Mean for Cold Outreach

A growing number of states, starting with California and followed by others including Virginia, have passed their own comprehensive privacy laws, each with its own definitions, thresholds, and rights granted to residents. They overlap in spirit but differ in real, material detail on scope and obligations.

Treat this as an evolving patchwork rather than a single settled rulebook, since new states continue to pass their own versions and existing ones get amended. A program built to satisfy one state's rules from a year ago may already be behind on a newer law that took effect since then.

Generally, these laws apply once a business processes personal data belonging to a state's residents above certain thresholds, which vary meaningfully from state to state. Whether your specific prospecting program crosses any given state's threshold depends on details like your data volume and revenue that only your attorney can properly assess against the current text of each law.

Don't rely on a generic rule of thumb you saw somewhere online; confirm the actual applicable thresholds with counsel before assuming your program is too small to matter.

Many of these laws grant residents a right to opt out of the sale or sharing of their personal data, and in some cases out of targeted advertising specifically. For a prospecting program, the practical implication is usually about having a real, working process to honor a request and keep that person off your lists going forward.

A request that gets honored in one tool but not another, because your data lives in five disconnected systems, is a real operational gap worth closing regardless of which specific law technically applies to you.

Maintain a single, shared suppression list that every outreach tool checks against before a send, rather than letting each tool keep its own separate list. Honor unsubscribe and deletion requests promptly, and keep a simple record of when a request came in and when it was processed.

Document where your prospecting data actually comes from, purchased lists, scraping, enrichment vendors, so you can answer a real question about your data sources if one ever comes up, rather than needing to reconstruct it after the fact.

Platforms like Vanta and Drata are built mainly around security and compliance frameworks such as SOC 2, and increasingly help document privacy-program evidence like your data inventory and request-handling process. That's useful for keeping an audit trail, but it isn't a substitute for legal advice on what a specific state's law requires for your prospecting program.

Use this kind of tooling to organize and evidence the process your attorney tells you to build, not to decide what that process needs to include in the first place.

Come prepared with specifics rather than a general question: where your prospecting data comes from, which states your typical outreach targets, roughly how many records you process, and what your current suppression and deletion process actually looks like today.

A conversation grounded in your actual program gets you a far more useful answer than asking generically whether "cold email is legal," since the real answer depends on details that only your specific setup can supply. Revisit that conversation whenever your target states or data volume change meaningfully, rather than treating one review as good indefinitely.

Bring these specifics to the conversation:

• Where your prospecting data comes from, whether purchased lists, scraping, enrichment vendors or another source, documented source by source.
• Which states your typical outreach targets, since thresholds and obligations differ from one state to the next.
• Roughly how many records you process, because volume is one of the details that determines whether a threshold applies.
• What your suppression and deletion process actually looks like today, including how requests are recorded and honored across every outreach tool.