California, United States
Consumer privacy law
CCPA: What California privacy rights mean for your website
The California Consumer Privacy Act (CCPA) gives California residents rights over how covered businesses collect, use, sell and share their personal information. The CPRA amended it, so today’s rules are assessed as one law. For most websites, the core task is a working opt-out of sale and sharing.
At a glance
- Who it can apply to
- For-profit businesses that do business in California, decide how personal information is processed and meet one threshold: annual gross revenue over $26,625,000 in the preceding calendar year (CPPA figure since January 1, 2025); buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or 50% or more of annual revenue from selling or sharing personal information.
- What it is
- The California Consumer Privacy Act, as amended by the CPRA from January 1, 2023, with regulations from the California Privacy Protection Agency (CPPA).
- Choices to offer
- Opt-out of sale and sharing for adults, through a link or alternative link plus opt-out preference signals such as GPC. Opt-in for consumers known to be under 16.
- Website actions
- Classify each tool as sale, sharing or service provider.
- Give notice at or before collection.
- Offer a working opt-out link, or frictionless signal handling.
- Honor GPC for the browser and any known profile.
- Route access, deletion and correction requests to every system.
- Primary sources
- CPPA FAQ, CPPA monetary thresholds, CCPA regulations and California Attorney General’s CCPA page
- Last reviewed
CCPA and CPRA: one amended law
California voters approved the California Privacy Rights Act (CPRA) in November 2020. It amended the CCPA, with the changes in effect from January 1, 2023, so there is no separate CPRA regime: assess your website against the CCPA as amended.
This guide covers scope and the core website journey. The CPRA guide explains what the amendments changed, including sensitive personal information, correction, retention and the 2025 regulations.
Who the CCPA covers
The thresholds at the top of this page come from the California Privacy Protection Agency’s FAQ. The revenue figure is adjusted for inflation every odd-numbered year: $26,625,000 has applied since January 1, 2025, and the next adjustment is due on January 1, 2027.
A business outside California can still be covered, as can affiliates that share a covered business’s branding and personal information. Some organizations and types of information are exempt. Website visits are not a substitute for the 100,000 consumers or households test.
Record why you are in or out of scope, and reassess when revenue, the business model or data practices change.
Sale, sharing, advertising and service providers
The opt-out covers sale and sharing. Whether a tool falls under it depends on what the recipient does with the data and the contract behind it, not on the tool’s name.
| Term | What it means | Covered by the opt-out? |
|---|---|---|
| Sale | What it meansDisclosing personal information to a third party for money or other valuable consideration. | Covered by the opt-out?Yes. |
| Sharing | What it meansDisclosing it to a third party for cross-context behavioral advertising, paid or not. | Covered by the opt-out?Yes. |
| Contextual or first-party advertising | What it meansAds based on the page being viewed or your own customer relationship, without data from other sites. | Covered by the opt-out?Not by itself. Check what any ad partner does with the data. |
| Service provider or contractor | What it meansProcesses data for you under a contract that restricts its use. | Covered by the opt-out?No, but it cannot provide cross-context behavioral advertising for you. |
Calling a tool “analytics”, or moving the same event from a pixel to a server-side connection, does not change the analysis.
What a working “Do Not Sell or Share” control looks like
A business that sells or shares personal information it collects online must offer at least two opt-out methods. One is processing opt-out preference signals such as GPC. The other is one of these:
- “Do Not Sell or Share My Personal Information” link in the homepage header or footer, which opts the visitor out at once or leads to an opt-out form.
- Alternative Opt-out Link: one “Your Privacy Choices” or “Your California Privacy Choices” link with the official opt-out icon, covering the opt-out and the right to limit sensitive personal information.
- No link: only if you process signals frictionlessly, the signal fully carries out the opt-out (including any offline sale or sharing) and your privacy policy explains it.
A generic cookie banner or cookie settings panel is not by itself an acceptable method, because it concerns collection, not sale or sharing. The control must name sale and sharing, take minimal steps and not require an account (CCPA regulations §7013, §7015 and §7026).
Example: an online shop’s footer link
Illustrative example: an online shop selling outdoor gear uses an advertising pixel and a weekly customer-list upload for cross-context behavioral advertising. Its footer link “Your Privacy Choices”, with the opt-out icon, opens a page that explains the right and offers two equally prominent buttons: “Opt out of sale and sharing” and “Keep current settings”. The current status is stated in words.
When the visitor opts out:
- The pixel stops sending this browser’s events to the platform for cross-context behavioral advertising.
- A signed-in customer’s account is flagged and left out of the next list upload.
- Third parties that received the data after the request, but before the shop acted, are told of the opt-out.
- The page confirms the result, for example “Opt-Out Request Honored”.
- Checkout, the basket and service-provider analytics continue.
Stop as soon as feasibly possible and within 15 business days; transfers you can stop instantly, such as real-time ad bidding, should stop at once. Then wait at least 12 months before asking the visitor to opt back in.
Honor opt-out preference signals
A covered business that sells or shares must treat a qualifying signal, such as Global Privacy Control, as a valid opt-out for that browser or device and any profile linked to it, and for the consumer if known. Posting the opt-out links does not remove this duty.
Test a first visit, a returning visit and a signed-in account, including server-side destinations. The Global Privacy Control guide covers conflicts with earlier choices and the required status message.
Notices and consumer requests
Personal information includes cookie identifiers, browsing activity and household-linked data. For each tool, record what it collects, why and who receives it, including embedded services and server-side integrations.
Give notice at or before collection: the categories, purposes and whether information is sold or shared, with a link to your privacy policy. Check lead forms, account sign-up and campaign landing pages as well as the homepage. The California Attorney General’s CCPA page summarizes these duties.
Support requests to know, delete, correct and receive portable information, subject to the exceptions, without penalizing people for using their rights. Verify identity proportionately for these requests; opt-outs need no verification. Make sure each request reaches the systems and suppliers that hold the data.
Website checklist
- Scope: record which threshold applies, or why none does.
- Recipients: label each tool as sale, sharing, service provider or contractor.
- Opt-out route: choose the link, the alternative link or frictionless signal handling.
- Effect: confirm pixels, server events and list uploads stop after an opt-out.
- Signals: test GPC on a fresh visit and on a signed-in account.
- Requests: follow an access, deletion and correction request through connected systems.
FAQ
Does the CCPA require consent for every cookie?
No. For adults, sale and sharing are opt-out. Other rules, including protections for children and other jurisdictions, can change what permission is needed.
Is a privacy policy enough?
No. Notices, opt-out handling and request processes need to reflect what actually happens. Written promises do not control data flows by themselves.
What changes for children?
Selling or sharing the personal information of consumers known to be under 16 requires affirmative authorization. For children under 13, that authorization must come from a parent or guardian. Wilfully disregarding a consumer’s age counts as knowing it.
Do we need a “Limit the Use of My Sensitive Personal Information” link?
Only if you use or disclose sensitive personal information for purposes beyond those the law permits. The Alternative Opt-out Link can cover both choices. The CPRA guide explains the right to limit.
Can we keep data after a deletion request?
Some exceptions may apply. Assess the specific information and reason, tell the consumer what you keep where required, and do not treat an exception as permission for unrelated reuse.
Who enforces the CCPA?
The California Privacy Protection Agency and the Attorney General. Administrative fines are up to $2,663 per violation, or $7,988 for intentional violations and those involving consumers known to be under 16 (CPPA figures from January 1, 2025). A limited private right of action exists for certain data breaches; it is not a general right to sue over every CCPA violation.