Skip to content

Language

CCPA / CPRA

Honor every California opt-out, including the ones sent by browsers

Cookiesh gives California visitors a one-click way to opt out of the sale and sharing of their data, treats Global Privacy Control as an opt-out automatically, and records each request.

Start free trialTalk to sales

At a glance

Applies to
For-profit businesses that meet the CCPA thresholds and handle California residents' data
Consent model
Opt-out of sale and sharing; opt-in for consumers known to be under 16
Penalties
Fines per violation, higher for intentional violations and minors' data
Enforced by
The California Privacy Protection Agency and the Attorney General

Requirements

What you need to get right

  1. Notice at collection

    Visitors must be told, at or before the point of collection, which categories of personal information you collect and why, including through cookies and pixels.

    How Cookiesh handles it: The California rule shows a short notice that links to your privacy policy and to the cookie declaration generated by the scanner.

  2. Opt-out of sale and sharing

    Advertising cookies and pixels can count as selling or sharing personal information. Covered businesses must offer a clear way to opt out, such as a "Do Not Sell or Share My Personal Information" link.

    How Cookiesh handles it: Visitors opt out of the marketing category in one click from the banner or from a footer link, and marketing scripts stop running right away.

  3. Global Privacy Control

    The CCPA regulations require businesses to treat an opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sale and sharing.

    How Cookiesh handles it: Cookiesh detects GPC, opts the visitor out of marketing before any tag runs, and can display that the signal was honored.

  4. Opt-in for minors

    Selling or sharing the personal information of consumers you know are under 16 requires opt-in authorization, from a parent if they are under 13.

    How Cookiesh handles it: Switch the California rule to opt-in for sites aimed at younger audiences. Nothing in the marketing category runs until the visitor agrees.

  5. Records of requests

    Businesses must keep records of consumer requests, including opt-outs, and how they responded.

    How Cookiesh handles it: Every opt-out is logged with its timestamp, region and method (banner, preference center or GPC), and can be exported as CSV or JSON.

Setup

Compliant in three steps

  1. Scan your site

    Cookiesh finds the advertising cookies, pixels and third-party scripts that may count as selling or sharing.

  2. Turn on the California rule

    The opt-out rule for California is on by default on Pro. Add other US states with similar laws, such as Colorado or Connecticut, in a few clicks.

  3. Add your opt-out link

    Place a "Do Not Sell or Share" link in your footer with data-cookiesh-open, then test with GPC turned on in your browser.

In depth

What are the CCPA and CPRA?

The California Consumer Privacy Act (CCPA) took effect in 2020. The California Privacy Rights Act (CPRA) amended it from 2023, added the concept of “sharing” personal information for cross-context behavioral advertising, and created the California Privacy Protection Agency to enforce the law alongside the Attorney General.

The law applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above an inflation-adjusted amount (originally $25 million), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning at least half their revenue from selling or sharing personal information.

How do cookies fit in?

Cookie IDs, device identifiers and browsing history are personal information under the CCPA. Analytics run strictly on your behalf by a service provider is usually not a sale. Third-party advertising cookies and pixels that let other companies track visitors across sites often are a sale or sharing, and that is what triggers the right to opt out.

Unlike the GDPR, the CCPA does not require consent before those cookies are set, except for consumers you know are under 16. It requires a clear notice, a working opt-out and respect for opt-out signals.

Why Global Privacy Control matters

Global Privacy Control is a browser setting that sends an opt-out signal with every request. California regulators have made clear that businesses must honor it, and enforcement actions have cited sites that ignored it. Because the signal arrives before any of your code runs, it has to be handled by the consent layer itself. Cookiesh reads it on page load, so marketing tags never start for visitors who sent it.

Sources

This page is general information, not legal advice. Laws and regulator guidance change, so review your setup with your legal team.

FAQ

Common questions

Do I need a cookie banner for the CCPA?

The CCPA does not require a consent banner in the GDPR sense. You do need a notice at collection and a working way to opt out of sale and sharing, and many sites use a banner or a footer link to deliver both.

Does the CCPA apply to businesses outside California?

Yes, if the business meets the law's thresholds and handles personal information of California residents. Having an office or staff in California is not required.

What about other US states?

A growing number of states, including Colorado, Connecticut, Virginia, Texas and Oregon, have similar opt-out laws, and several also require businesses to honor universal opt-out signals. Cookiesh lets you apply the opt-out rule per state.

Can I use one banner for California and the EU?

You can show an opt-in banner everywhere, which meets California's rules too, but you may lose data you are allowed to collect. Most sites use geo-targeting to show each audience the experience its law requires.

Related guides

Ship compliant cookie banners in minutes, not sprints

Start free on one domain. Upgrade when you need more domains, geo-targeting or custom branding.

Start free trialTalk to sales

No credit card required · Cancel anytime