If exempting "commercial purposes" from a law results in no harm being done to anyone, then you are arguing the law is shouldn't exist in the first place.

CCPA appears to limitations based on the size of the enterprise, so that doesn't guarantee protection.

So, which state laws prevent someone from wiretapping my communications and then selling it?