CCPA: What California privacy rights mean for your website

Does CCPA apply to your business?

The CCPA applies to certain for-profit businesses doing business in California that determine the purposes and means of processing personal information. A business generally falls within scope if it meets at least one relevant threshold:

• Revenue: annual gross revenue above $26,625,000 in the preceding calendar year, using the inflation-adjusted threshold applicable in 2026.
• Data volume: buying, selling or sharing the personal information of at least 100,000 consumers or households annually.
• Business model: deriving at least 50% of annual revenue from selling or sharing consumers’ personal information.

The California Privacy Protection Agency’s FAQ explains coverage, thresholds and related rules. Exemptions and other routes into scope can affect the assessment. An overseas business is not automatically outside the law, and website visits are not a direct substitute for the statutory volume calculation.

Record why you are in or out of scope and reassess when your revenue, business model or data practices change.

CCPA and CPRA: one amended framework

The California Privacy Rights Act, or CPRA, amended the CCPA. It added and strengthened requirements rather than creating a second, unrelated cookie law.

This guide focuses on the everyday website journey: notice, opt-out and individual requests. The separate CPRA guide explains the added governance, sensitive-information and operational considerations. Your website should implement the current CCPA as amended, not choose between the two names.

Five things to get right

1. Know what counts as personal information

Cookie identifiers, browsing activity and information linked to a household can be relevant. Do not limit your inventory to names and email addresses.

For each tool, record what is collected, the purpose and who receives it. Include advertising pixels, embedded services and server-side integrations. A recipient’s role and contractual restrictions can affect the legal analysis.

2. Provide notice when information is collected

Visitors need appropriate information at or before collection. Explain the relevant categories and purposes, and provide access to the fuller privacy policy.

The California Attorney General’s CCPA guide describes notice and consumer rights. Make the information easy to find on the actual journey: a lead form, account registration or campaign landing page may need attention alongside the homepage.

Keep the policy aligned with live practices. A new advertising integration should trigger a notice review before it starts receiving data.

3. Assess sale and sharing honestly

A sale is not limited to handing over a mailing list for cash. Valuable consideration can be relevant. Sharing includes specified cross-context behavioural advertising, even without a monetary exchange.

Map your advertising arrangements against these definitions. Calling a tool “analytics” or saying you never sell data does not settle how the recipient uses the information.

Where applicable, provide the required sale and sharing opt-out mechanism and links, or a permitted compliant alternative. Make the effect clear: the choice should control the relevant data use, not merely hide the banner.

4. Honour browser opt-out signals

Covered businesses must handle qualifying opt-out preference signals as required. The Attorney General’s GPC guidance explains Global Privacy Control as a way to exercise the sale or sharing opt-out.

Test the first page load, returning visits and known account profiles. Check relevant advertising destinations and server-side flows. Do not require a visitor to repeat a valid browser signal through a separate banner choice before applying it.

5. Make requests work beyond the banner

Support applicable rights to know or access information, delete, correct and receive portable information, subject to relevant rules and exceptions. Consumers also have protection against unlawful discrimination for exercising their rights.

Build a process for receiving, assessing and responding to requests. Use proportionate verification where required, while avoiding unnecessary information collection. Opt-out requests are not simply the same workflow as verified access requests.

Your internal process should identify the systems and suppliers involved. A confirmation email is not enough if the request never reaches the relevant data.

What this means for your advertising

A California opt-out does not necessarily mean every form of advertising must stop. The key issue is the activity covered by the choice. Contextual advertising and properly restricted service-provider arrangements require their own analysis.

For example, a retailer may continue showing a general promotion on its website while stopping the sharing used to build cross-site advertising audiences for an opted-out customer.

Evaluate the actual configuration and contracts. Do not assume that moving the same event from a pixel to a server removes the opt-out obligation.

Website checklist

• Check scope: review thresholds, exemptions and relevant corporate relationships.
• Check collection: inventory identifiers, events, forms and recipients.
• Check notices: show appropriate information before or when collection occurs.
• Test opt-out: confirm applicable sale and sharing stop across relevant tools.
• Test GPC: include a fresh visit and an associated known profile.
• Check requests: test access, deletion and correction workflows.
• Check children’s data: review additional opt-in requirements where relevant.
• Review changes: keep policies, vendor arrangements and actual practices aligned.

FAQ