Emails on query strings are leaks that should be patched. That said you can bet these companies are sending emails over formal integrations to tons of 3rd parties for analysis, targeting, advertising, etc.
CCPA is not nearly as strict as the GDPR and it is not illegal, unfortunately.