Responsible use

California Realtor Data Compliance & Outreach Guidance

Practical safeguards for customers using realtor contact data and the evidence CARealEstateList must complete before presenting this page as an approved compliance program. This guidance is not legal advice or permission for a specific campaign.

Review the campaign checklistSee business review items
  • Email, phone and text treated separately
  • Privacy choices carried into suppression
  • Unverified business controls labelled clearly
Scope and responsibility

The data file and the campaign are separate compliance decisions

Buying a contact field does not establish consent, remove suppression duties or make every downstream use lawful. The sender or caller remains responsible for the actual audience, purpose, channel, technology, message, timing and jurisdictions involved. Requirements can also change by state and industry.

Channel safeguards

Review each outreach channel on its own rules

A record may contain several contact methods. Approval for one method should not be treated as approval for another.

Commercial email

A purchased business email is not automatic permission to send any message. Classify the message, audience and applicable jurisdictions before a campaign.

  • Use accurate sender, domain and routing information and a subject that describes the message honestly.
  • Identify commercial content as advertising where required and include a valid physical postal address.
  • Provide a clear opt-out method, keep it available for the required period and honor requests within the applicable deadline.
  • Keep an organization-wide suppression list and monitor agencies, platforms and other vendors sending on your behalf.

Calls and text messages

Rules depend on the recipient, number type, campaign purpose, technology, consent and state. Do not treat a phone or mobile field as a blanket right to call or text.

  • Determine whether federal or state Do Not Call screening, an internal suppression list or consent is required before contact.
  • Apply the stricter review needed for automated, prerecorded, artificial-voice and marketing-text activity.
  • Transmit accurate caller identification, observe permitted hours and identify the responsible seller or caller.
  • Accept reasonable revocation and do-not-contact requests, stop covered activity promptly and retain the suppression record.

Privacy rights and downstream use

Public-source or professional-license information does not make every appended field, transfer or downstream use unrestricted.

  • Determine which notice, access, correction, deletion, limitation and sale/share opt-out duties apply to your organization.
  • Respect applicable opt-out preference signals such as Global Privacy Control and do not reactivate suppressed records for marketing.
  • Do not sell, share or upload the file to another provider unless your contracts, notices and legal basis allow it.
  • Route privacy requests to a trained owner and propagate required actions to service providers, contractors and recipients.

Security and data minimization

Keep only the fields and records needed for a documented business purpose, with controls appropriate to a large contact dataset.

  • Limit access by role; protect downloads, exports, credentials and backups; and log material transfers.
  • Set retention and secure-deletion periods instead of keeping every purchased copy indefinitely.
  • Do not enrich records into sensitive profiles or use them for eligibility, surveillance or other unapproved decisions.
  • Maintain an incident-response path and promptly investigate suspected loss, misuse or unauthorized access.
Pre-campaign workflow

A six-step review before any upload or send

Use one documented sequence across in-house teams, agencies and platforms so that a privacy or do-not-contact choice is not lost between systems.

  1. 1

    Define the purpose and audience

    Record the offer, recipient category, selected fields, locations, channels and why the outreach is relevant.

  2. 2

    Classify the legal requirements

    Review federal, state and sector rules, consent, Do Not Call and privacy obligations for the actual campaign—not the file in isolation.

  3. 3

    Screen and suppress

    Apply the appropriate registries, consent evidence, company opt-outs, privacy requests and internal exclusions before launch.

  4. 4

    Send a truthful, relevant message

    Identify the sender, avoid deceptive claims, use a defensible frequency and provide the required contact and opt-out information.

  5. 5

    Honor responses across systems

    Stop covered outreach, update the master suppression record and notify vendors or downstream systems when required.

  6. 6

    Retain a review record

    Keep the campaign approval, list version, screening date, consent basis, message, vendor and request-handling evidence.

Prohibited use baseline

Uses this product should never enable

These restrictions are a minimum responsible-use baseline. Final customer terms should add enforceable suspension, investigation and remedy provisions.

  • Harassment, threats, stalking, doxxing, impersonation, fraud or deceptive solicitation.
  • Discrimination or decisions about housing, employment, credit, insurance or other eligibility based on protected or sensitive traits.
  • Attempts to evade an unsubscribe, do-not-call, deletion, sale/share opt-out or other privacy choice.
  • Publishing raw records, credentials or private contact details, or reselling data without documented authorization and required notices.
  • Combining records to infer health, precise location, immigration, financial distress or other sensitive characteristics for targeting.
  • Automated calls, texts or high-volume outreach without the required campaign-specific review, consent and suppression controls.
CARealEstateList review gate

Controls the business must prove before indexing

These are not completed-control claims. Each item needs a named owner, written procedure, retained evidence and qualified legal review.

Evidence required

Source and permission record

Document every source category, collection path, acquisition date, permitted uses, restrictions and proof supporting each transferred field.

Legal review required

California privacy applicability

Determine CCPA/CPRA coverage, applicable notices, request methods, response workflow, Global Privacy Control handling and sale/share disclosures.

Immediate determination

Data-broker obligations and DROP

Determine whether CARealEstateList meets California's data-broker definition. If it does, verify registration and the current DROP access, deletion, opt-out and downstream-instruction workflow.

Control required

Suppression propagation

Define how unsubscribe, do-not-call, deletion and sale/share choices are matched, retained and applied to active files, future releases, vendors and required recipients.

Contract review required

Customer terms and enforcement

Add acceptable-use restrictions, customer representations, channel-specific responsibilities, audit/cooperation terms and suspension rights that match actual checkout and delivery.

Operational proof required

Security, retention and incidents

Approve access roles, storage and transfer controls, retention periods, deletion evidence, vendor oversight and an incident-response owner.

Time-sensitive California review

The California Privacy Protection Agency says qualifying data brokers began processing DROP deletion requests on August 1, 2026 and must access the mechanism at least once every 45 days. CARealEstateList needs an immediate, documented applicability determination; this page does not assume either that it qualifies or that it is exempt.

Primary guidance

Official resources reviewed August 25, 2026

Regulations and interpretations change. Recheck the official source and obtain advice for the campaign and business model in use.

Questions, rights or corrections

Use the current legal pages while review continues

Review the current Privacy Policy, CCPA information and Terms & Conditions. Contact support about a privacy request, suppression, permitted use or correction before using the data when the answer is material to your campaign.

Contact support