The limits are defined in what is considered to be a "commercial business purpose":

> (e) “Commercial business purpose” means the processing of personal information that satisfies either of the following criteria:

> (1) Is performed to further a business purpose as defined in subdivision (e) of Section 1798.140 of the Civil Code.

> (2) Is subject to a consumer’s opt-out rights under Sections 1798.120, 1798.121, and 1798.135 of the Civil Code.

Specifically what OP describes is §1798.140(e): https://leginfo.legislature.ca.gov/faces/codes_displaySectio....

So it is fairly limited.