Donor data and privacy: the rules that apply to fundraising

This guide is for whoever keeps your donor list, sends your fundraising emails or chooses your donor database. Donor records hold names, addresses, giving history and sometimes notes about family, health or wealth. Donors trust you with them, and a growing number of laws say how they must be handled. After reading, you'll know which state privacy laws cover nonprofits and which don't, what the federal CAN-SPAM rules mean for fundraising email, and the habits that keep you on the right side of both.

Our guide to data privacy basics covers the general habits for all the information your charity holds. This guide focuses on donors and fundraising.

State privacy laws: some cover nonprofits, some don't

There's no single federal privacy law for charities. Instead, a growing number of states have comprehensive consumer privacy laws that give residents rights over their personal data, such as the right to see it, correct it, delete it and opt out of its sale. Whether they apply to your charity depends on the state, on whether the law exempts nonprofits, and on how many people's data you hold.

What matters is where the people in your records live, not only where your charity is based. Here are five examples, each from the state's own law or attorney general:

In Colorado, Oregon and Delaware, the law also applies only if you do business in the state or offer products or services to (or targeted at) its residents. Most small charities are well below these thresholds. But Delaware's lower numbers, especially from 2027, could reach a charity with a large mailing list there, and other states have passed or are passing similar laws with their own rules. Check the law of each state where you hold a lot of donor records, and ask a lawyer if you're close to a threshold.

Fundraising email and CAN-SPAM

The federal CAN-SPAM Act covers email whose "primary purpose" is the commercial advertisement or promotion of a product, service or website. The Federal Trade Commission (FTC) enforces it, and its guide says "the law makes no exception for business-to-business email." The FTC's guide doesn't say how the law treats nonprofits or a plain appeal for donations, so don't assume your email is outside it. Emails that promote ticket sales, merchandise or a sponsor's product are the most likely to count as commercial. The simplest approach is to follow the rules for every fundraising email.

According to the FTC's compliance guide:

• Headers must be accurate. The "From", "To" and "Reply-To" must identify who's sending.
• The subject line must not mislead.
• Identify an ad as an ad, if the message is one.
• Include a valid postal address.
• Give a clear way to opt out, and keep it working for at least 30 days after you send.
• Honor opt-outs within 10 business days.
• You're responsible for vendors. Hiring an email service doesn't transfer the legal duty.

The FTC says each separate email that breaks the law can bring penalties of up to $53,088. Transactional or relationship messages, such as a receipt confirming a gift, are largely exempt, but the FTC reads that category narrowly. A receipt that leads with a sales pitch is treated as commercial.

Our guide to email newsletters covers building a list with consent and using a proper email service.

Sharing, renting or swapping your list

Some charities rent or swap donor lists to find new donors. Before you do:

• Check what you promised. Your privacy notice and donation pages decide what you're allowed to do.
• Check state law. In states whose privacy laws cover nonprofits, renting or swapping a list may count as a "sale" of personal data, and Oregon's law, for example, gives people the right to opt out of the sale of their data. Ask a lawyer before you start.
• Offer a choice. If you share at all, let donors opt out easily, and honor it.

Many small charities simply promise never to sell, rent or swap their list. It's the easiest promise to keep.

Prospect research and notes

Looking up public information about likely major donors is common. Keep it respectful:

• Use public, relevant information only, such as public giving records or board roles. Don't record rumors or private details.
• Write notes as if the donor could read them, because in some states they may have the right to ask.
• Limit access. Not every volunteer needs to see giving history or research notes.
• Delete what you no longer need. Old notes are a risk, not an asset.

A donor privacy notice

Put a short, plain privacy notice on your website and link it from every donation form. Say:

• what donor information you collect, and why
• how you use it (thank-you letters, receipts, updates, appeals)
• who you share it with (for example, your payment processor and email service), and whether you ever sell, rent or swap it
• how donors can opt out of mailings, update their details or ask what you hold
• how you keep it secure, and how long you keep it
• whom to contact with questions

Review it every year, and whenever you change systems or start a new kind of fundraising.

Requests from donors

Even where no law requires it, respond quickly when a donor asks to:

• stop receiving mail, email or calls: record it in your database the same day
• see what you hold about them
• correct their details
• be removed: delete what you can, and keep only what you must for tax and accounting records, such as gift amounts and dates

Keep a simple log of requests and what you did.

If donor data is exposed

States have their own laws on telling people when their personal information is exposed in a security breach. If donor data is lost or stolen, follow the steps in our guide to data privacy basics and your state's notification law, and see cybersecurity basics to prevent it happening again.

Donor privacy checklist

• We know which states most of our donors live in, and checked those states' privacy laws
• Our donation forms link to a short, plain donor privacy notice
• We do what our notice promises, including on list sharing
• Fundraising emails have an accurate sender, honest subject line, postal address and working opt-out
• Opt-outs are honored within 10 business days
• Prospect research uses only public, relevant information, and notes are respectful
• Access to full donor records is limited to people who need it
• We log and answer donor requests to stop contact, see, correct or remove their data