Are emails and Slack messages sensitive personal information under the CPRA?

Short answer: sometimes, depending on the recipient

Sometimes. The CPRA amendments to the California Consumer Privacy Act list "the contents of a consumer's mail, email, and text messages unless the business is the intended recipient of the communication" as sensitive personal information. Whether a given Slack or email archive falls inside that phrase depends on who sent each message, who it was meant for and whose data it is.

The text is in the definitions section of the California Civil Code CCPA title. Read the statute itself rather than a summary, and check the California Privacy Protection Agency's current regulations, which were updated for 2026.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What does "unless the business is the intended recipient" change?

It splits a mail system into two rough piles. The first is messages addressed to the company, such as a customer writing to sales. The second is messages the company holds but was not the intended recipient of, such as a worker's private exchange with a family member sitting in a work mailbox.

The table is a checklist of questions, not an answer. The statute's reach to employee and business-contact data is a point for counsel, not for a referral partner.

What does "sensitive" trigger?

Under the CCPA, a consumer can ask a business to limit its use of sensitive personal information to certain permitted purposes, and the business has notice duties about collecting and using it. The California Attorney General's overview lists the right to limit use of sensitive personal information among consumer rights since January 1, 2023.

The consequence for licensing is practical rather than abstract. A company that wants to hand message contents to a third party should assume that sensitive categories will need either removal, deidentification or a lawful basis its counsel has approved. The statute is also not the only constraint: privacy-policy promises, customer contracts, NDAs and other states' laws apply as well.

Why does redaction come before any license?

A message archive is a mix of categories. Alongside project talk there can be health details, family matters, HR complaints, account numbers and credentials pasted into a chat. Because one thread can mix categories, the safe order of work is:

1. Decide what is in scope by system and date range, not by individual message.
2. Exclude whole categories first: personal-domain correspondents, HR and medical channels, anything under legal hold or privilege.
3. Detect and mask identifiers, including names and account numbers inside the message text.
4. Pseudonymize speakers so threads stay coherent but people are not named.
5. Sample and review the output with the company's counsel before anything is delivered.

Pseudonymization alone is not deidentification under the statute. The CCPA deidentified data definition explains the three commitments a company must make before it can rely on that label.

What does this mean for communications-heavy companies?

Email and chat are among the most valuable records because they show real work: requests, clarifications, decisions and outcomes. That is why AI buyers ask about them. It is also why a mailbox archive is never licensed as a raw export. SourceX agrees de-identification and redaction requirements with the company before any work begins, and data is delivered only after an executed agreement and the company's authorization.

Ownership is a separate question from privacy. See who owns emails sent to a company for the customer-message side. Neither question is settled by a referral partner.

What should a referral partner say?

Partners give basic fit information only and never open, export or describe messages. A short, honest line works better than reassurance.

If the owner asks whether the company is "allowed", the answer is that it depends on facts and law the partner cannot assess. The too-sensitive objection answer covers the standard reply. For free-text health content, the sibling guide on de-identifying free text under HIPAA applies instead.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

When to walk away

• The company's main asset is consumer messages with no licensing basis.
• Nobody can say which workspace holds personal chats and which holds project chats.
• Counsel has told the owner not to share message contents, and the owner agrees.
• The archives were deleted or cannot be exported.

Next step

Run the company fit checker on the company, then register as a partner to make the introduction. Owners can also apply at sourcex.si/apply, and the how it works page shows what happens after.