Not in California, but spent some time several years ago working on the tech for a sales arm.
My impression there was that people where pretty conscious of opt-outs and wanting to manage them carefully, if only because the consequences of not doing so could be costly. We spent a lot of time talking about opt-outs and trying to honor them across different tools they used.
Many prospects came from purchased lists. Some were contracts where some other firm was specifically handling a marketing campaign for us, but others were clearly just purchased from a data broker who, presumably, filtered their data for people who indicated an interest in us.
When we asked how to handle these, the decision was that if you showed up on one of these lists, you had opted in. After all, that is what the broker told us.
This presents the first problem: If you buy data from a broker who you have not specifically engaged to campaign on your behalf, its a little gray what that data actually represents. This may be resolved by probing into to broker's collection and segmentation more, but as far as I can tell there's not a lot of incentive for the decision makers to care.
Anyways, I was not particularly thrilled with this approach, especially after working with some lists we purchased several times a year that always had a significant number of duplicates time after time. So I wrote that particular import to check for duplicates and filter them out.
Well, this worked great until the prospects, having no recent activity, grew stale and were cleaned from the system. Then when they showed up in the list again wouldn't match and get a fresh new subscription.
Which presents the second problem: If you don't hold on to their identifiable information, you cannot determine if they have previously requested to be removed from your offerings. So it may be dumb to have to opt out again, bit the alternative is to trust them not to use your information in the mean time.