CCPA and CPRA: what US privacy law means for cookies

The CCPA, as amended by the CPRA, does not require consent before setting cookies. Instead, it treats many advertising cookies and pixels as a “sale” or “sharing” of personal information and gives California residents the right to opt out. Covered businesses must disclose what they collect, offer a clear opt-out link and honor browser signals such as Global Privacy Control.

What are the CCPA and CPRA?

The California Consumer Privacy Act (CCPA) is California’s main consumer privacy law. The California Privacy Rights Act (CPRA) amended and expanded it, so “CCPA” today usually means the combined, amended law.

The CPRA added new rights, introduced “sharing” as a concept for cross-context behavioral advertising and created a dedicated regulator, the California Privacy Protection Agency (CPPA). The agency writes detailed regulations and shares enforcement with the California Attorney General.

The law applies to for-profit businesses that do business in California, handle California residents’ personal information and meet at least one threshold. Those thresholds are annual gross revenue above a set amount that is adjusted for inflation, buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of annual revenue from selling or sharing personal information. You do not need an office in California to be covered.

Do cookies count as personal information under the CCPA?

Often, yes. The CCPA defines personal information broadly, and its definition of unique identifiers explicitly mentions cookies, beacons and pixel tags.

Cookie IDs, advertising IDs, IP addresses and browsing history linked to a consumer, household or device all typically qualify. What matters is what happens to that data next. A first-party session cookie that keeps someone logged in raises few CCPA issues, while a third-party ad pixel that sends browsing activity to an ad network is a different story.

When is a cookie a “sale” or “sharing”?

A cookie becomes a sale or sharing when it lets a third party receive personal information for its own purposes or for cross-context behavioral advertising. Money does not have to change hands.

• Sale means disclosing personal information to a third party for monetary or other valuable consideration. Free tools that you effectively pay for with visitor data can qualify.
• Sharing means disclosing personal information to a third party for cross-context behavioral advertising, meaning ads targeted using a person’s activity across other businesses’ sites and apps, whether or not anything of value is exchanged.
• Service providers and contractors that process data only on your behalf, under a contract containing the terms the law requires, are generally not third parties, so disclosures to them are not sales.

In practice, retargeting pixels, ad network cookies and social media tracking pixels are the usual suspects. Run a cookie audit to map which vendors receive data and under what contracts before you classify each one.

How does the CCPA compare with GDPR for cookies?

The core difference is the default. EU rules require opt-in consent before non-essential cookies load, while California lets them load but requires an easy way to opt out.

	GDPR and ePrivacy (EU)	CCPA and CPRA (California)
Model	Opt-in before non-essential cookies	Opt-out of sale and sharing
Consent banner	Effectively required	Not required
Key user control	Accept and reject choices	“Do Not Sell or Share My Personal Information” link
Browser signals	Legal effect less settled	Must honor opt-out preference signals such as GPC
Children	Special rules for children’s consent	Opt-in before selling or sharing data of under-16s
Enforcement	National data protection authorities	CPPA and California Attorney General

If you serve both audiences, geo-targeting lets you show an opt-in banner in the EU and an opt-out experience in California. For the EU side, see GDPR cookie consent requirements.

What does your website need?

Covered businesses need clear disclosures, an opt-out mechanism and the back-end processes that make the opt-out real. Use this checklist as a starting point.

1. Notice at collection. At or before the point of collection, tell people what categories of personal information you collect, why, whether you sell or share it and how long you keep it.
2. Privacy policy. Describe consumer rights and how to exercise them, and update the policy at least once every 12 months.
3. Opt-out link. Provide a clear “Do Not Sell or Share My Personal Information” link, or the single alternative opt-out link the regulations permit, usually in the site footer.
4. Honor GPC. Treat a Global Privacy Control signal as a valid opt-out for that browser, and for the consumer’s account if you know who they are.
5. Stop the data flow. When someone opts out, stop firing the tags that sell or share their data. A link that only records a preference is not enough.
6. Limit sensitive data. If you use sensitive personal information beyond the purposes the law permits, offer a “Limit the Use of My Sensitive Personal Information” link.
7. Keep records. Log opt-out requests and how you handled them, as you would for proof of consent records, so you can show your process works.

What about other US states?

California is no longer alone. A growing number of US states have passed comprehensive privacy laws with similar rights to opt out of targeted advertising and the sale of personal data, and several require businesses to honor universal opt-out signals.

The details differ, including applicability thresholds, definitions and whether some data, such as sensitive data, needs opt-in consent. Check each law that applies to your audience. Building one robust opt-out flow that honors GPC everywhere is often simpler than maintaining state-by-state exceptions.

Bottom line

For cookies, the CCPA and CPRA are about transparency and a working opt-out, not prior consent. Identify which trackers sell or share data, give Californians a clear way to say no, honor GPC automatically and make sure opting out actually stops the data flow. Tools like Cookiesh can serve geo-targeted CCPA banners and honor GPC signals for you.

This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.