Address Data Under GDPR and CCPA: What You Can and Cannot Do With Customer Addresses

Customer addresses are personal data under both GDPR and CCPA, subjecting them to the full weight of privacy regulation. For businesses collecting addresses — especially across borders — understanding these requirements is essential to avoiding significant legal and financial penalties.

GDPR: Address as Personal Data

Under the EU's General Data Protection Regulation, a physical address is explicitly personal data because it can identify a natural person. This means: you need a lawful basis to collect it (consent, contractual necessity, or legitimate interest), you must clearly state the purpose of collection, you can only use it for the stated purpose, you must protect it with appropriate security measures, you must delete it when the purpose is fulfilled, and you must provide it to the individual upon request (data portability). The penalties for GDPR violations are severe — up to 4% of global annual turnover or €20 million, whichever is greater.

CCPA: California's Framework

The California Consumer Privacy Act (and its amendment, the CPRA) gives California residents specific rights regarding their personal information, including addresses: the right to know what information you've collected, the right to request deletion, the right to opt out of the sale of their information, and the right to non-discrimination for exercising their rights. Unlike GDPR, CCPA applies based on the consumer's location (California residents), not the business's location. Any business serving California customers that meets the CCPA thresholds must comply.

Practical Compliance Steps

For businesses handling address data: minimize collection (only collect address fields you actually need), secure storage (encrypt address data at rest and in transit), implement access controls (not every employee needs access to full customer addresses), establish retention policies (delete or anonymize addresses after the business need expires), document your data processing activities, and respond to data subject requests within the legally required timeframe (30 days under CCPA, one month under GDPR).

International Data Transfers

Transferring customer addresses across borders — for example, from an EU customer to a US-based fulfillment center — requires additional safeguards under GDPR. Standard Contractual Clauses (SCCs), the new EU-US Data Privacy Framework, or binding corporate rules may be required depending on the destination country and the nature of the transfer. Ignoring cross-border transfer requirements has resulted in significant enforcement actions, including the landmark Schrems II decision that invalidated the EU-US Privacy Shield.

Address Data in Marketing

Using customer addresses for direct mail marketing adds another compliance layer. GDPR requires either consent or legitimate interest as the legal basis for marketing use. CCPA requires providing an opt-out mechanism. CAN-SPAM (for email) and TCPA (for phone/SMS) have their own address-related requirements. The safest approach: collect addresses for fulfillment, use them for marketing only with explicit consent, and make it easy for customers to opt out of address-based marketing while retaining their fulfillment address on file.