California’s CCPA is the strongest privacy law in the US but still does not prevent you from using your first party data. The three main things you need to do to comply with the law are: Inform the consumer that you collect personal information for marketing purposes. This is usually done via a paragraph in the privacy policy. Give the consumer a way to Opt Out. This is usually done by providing an email address that they can send an opt out request to and is part of the same paragraph in the privacy policy. You also need to abide by any requests you receive by removing them from your marketing database. Do not sell the data. The laws view your website visitors as your first party data and you are free to use it but to sell it you must get explicit permission.