ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXCalifornia's consumer privacy law, explained in plain English, including consumer rights, opt-out requirements and what it means for your website.
In 2020, California voters approved the California Privacy Rights Act (CPRA), which amended the CCPA rather than replacing it. The CPRA changes took effect on January 1, 2023. They added the right to correct data, extra protection for sensitive personal information, and a dedicated enforcement agency, the California Privacy Protection Agency (CalPrivacy).
The CCPA can apply to businesses outside California too. If your website collects personal information from California residents and you meet the law's thresholds, it is worth checking your obligations. See our CCPA compliance guide for the full picture.
For most websites, CCPA compliance usually means four things: a clear privacy notice, a "Do Not Sell or Share My Personal Information" link, support for Global Privacy Control (GPC) signals, and a way for people to send requests to know, delete or correct their data.
CCPA stands for California Consumer Privacy Act. At its core, it is a law about choice: people can see what a business collects about them, and they can tell the business to stop selling or sharing it.
The law covers how businesses collect, use, disclose, sell and share personal information. It is built around three ideas:
This is different from GDPR. Under GDPR, a business often needs permission before it starts processing data. Under CCPA, a business can generally start, but it must stop selling or sharing when a consumer says no. That is why CCPA compliance depends so much on a working opt-out link and on honouring Global Privacy Control signals.
If you serve visitors from both regions, you need a setup that applies different rules by location, such as the Region Rule Engine.
CPRA stands for the California Privacy Rights Act.
The CPRA was approved by California voters through Proposition 24 in 2020. Rather than replacing the CCPA with a completely separate law, the CPRA amended the existing CCPA and introduced additional consumer rights and business obligations.
The CPRA amendments became effective on January 1, 2023.
The CCPA provides privacy rights to California residents.
The California Privacy Protection Agency explains that a California resident is an individual who resides in California, including certain employees, job applicants, students, independent contractors and business contacts.
The law is therefore focused on the privacy rights of people rather than corporations or other business entities.
Who must comply:
The CCPA applies to a for-profit business that does business in California and meets at least one of these:
You do not need an office in California. If you collect data from California residents through your website, the law can apply to you.
Who enforces it:
The California Privacy Protection Agency (CalPrivacy) and the California Attorney General both enforce the CCPA. They can investigate complaints, run audits and bring enforcement actions.
Penalties:
The current fines are about $2,663 per violation and $7,988 per intentional violation or violation involving minors. Each affected consumer can count as a separate violation, so the total can grow quickly. A working opt-out and GPC setup is much cheaper than a penalty.
2026 rule changes:
The CCPA regulations effective January 1, 2026 added requirements for risk assessments, cybersecurity audits and automated decisionmaking technology (ADMT). Each has its own deadline, so check which ones apply to your business.
How ConsentX helps:
CCPA compliance with Global Privacy Control handling and audit-ready consent records.
The CCPA defines personal information broadly.
It generally includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household.
Examples can include:
The CCPA also distinguishes sensitive personal information, which receives additional protections. Examples include precise geolocation, certain financial information, account credentials, health information, genetic information and certain biometric information.
Sensitive personal information (SPI) is a category of personal information that receives additional protection under the CCPA.
Depending on the circumstances, sensitive personal information can include:
Consumers have a right to limit the use and disclosure of sensitive personal information in circumstances covered by the law.
The CCPA provides California residents with several important privacy rights.
Consumers can request information about:
Consumers can request deletion of personal information collected about them, subject to statutory exceptions.
Businesses may be required to direct applicable service providers or contractors to delete information as well.
Consumers can request correction of inaccurate personal information maintained by a business.
Consumers can opt out of the sale or sharing of their personal information in circumstances covered by the CCPA.
The right to opt out of sharing is particularly relevant to cross-context behavioral advertising.
Consumers can limit certain uses and disclosures of their sensitive personal information.
Businesses generally cannot discriminate against consumers for exercising their CCPA rights.
California's updated framework also includes rights and obligations relating to certain uses of Automated Decisionmaking Technology (ADMT).
Applicable businesses using ADMT for significant decisions may have additional notice, opt-out and access-related obligations. The relevant ADMT requirements have their own implementation timelines.
One of the defining features of the CCPA is the consumer's right to opt out of the sale or sharing of personal information where applicable.
A business that sells or shares personal information may need to provide consumers with an appropriate mechanism to exercise this right.
For websites, this commonly appears as:
“Do Not Sell or Share My Personal Information”
or an equivalent privacy-choice mechanism.
The opt-out mechanism should be easy to find and use.
Do Not Sell or Share My Personal Information is a CCPA privacy-choice mechanism that allows consumers to exercise their right to opt out of certain sales or sharing of personal information.
The concept is especially relevant to:
A website should connect the consumer's privacy choice to the technical systems that process or share the relevant information.
Simply displaying a link without enforcing the resulting preference can create a gap between the website's stated privacy controls and its actual behaviour.
Global Privacy Control (GPC) is a browser or user-agent signal that communicates a consumer's privacy preference to websites.
Under the CCPA framework, covered businesses must honour qualifying opt-out preference signals in the circumstances required by law.
The California Privacy Protection Agency specifically identifies opt-out preference signals as a mechanism through which consumers can exercise their opt-out rights.
For a website, this means privacy compliance cannot necessarily depend only on a visitor manually clicking a "Do Not Sell or Share" link.
A compliant implementation should be capable of detecting and appropriately responding to applicable privacy signals.
The CCPA does not simply regulate "cookies" as a standalone category.
The relevant question is what information a cookie, pixel, SDK or similar technology collects or enables a business or third party to process.
Website technologies that may be relevant include:
Businesses should therefore evaluate their tracking technologies against their CCPA obligations rather than assuming that a particular cookie category is automatically compliant or non-compliant.
Not in the same way as the GDPR.
The CCPA generally centres on transparency and consumer rights, particularly the right to opt out of the sale or sharing of personal information.
This is different from the GDPR's approach to consent as one of several lawful bases for processing.
However, businesses may still need privacy choices, disclosures and technical controls for cookies and tracking technologies depending on what those technologies do and whether the associated processing falls within CCPA requirements.
This distinction is why a CCPA privacy preference centre should not simply be copied from a GDPR consent banner without considering the applicable legal framework.
A useful way to understand the difference is:
| GDPR | CCPA |
|---|---|
| Often requires prior consent where consent is the applicable basis | Generally emphasises consumer opt-out rights |
| Consent can be required before certain processing | Opt-out is particularly important for sale/sharing |
| Prior blocking may be required where consent is necessary | Technical enforcement should respect opt-out preferences |
| Consent must meet specific validity requirements | Businesses must provide mechanisms for exercising CCPA rights |
| Consent withdrawal is important | Opt-out preference must be honoured |
These frameworks can overlap, but they should not be treated as identical.
A business operating globally may need a consent model capable of adapting to the user's jurisdiction.
The CCPA and GDPR are both major privacy laws, but they use different regulatory approaches.
The GDPR is a comprehensive European data-protection regulation focused on lawful processing, data-subject rights, accountability, security and other privacy principles.
Consent is one of several lawful bases for processing.
The CCPA focuses heavily on consumer transparency and rights, including the right to know, delete, correct, opt out of sale or sharing, and limit certain uses of sensitive personal information.
The two frameworks therefore overlap but are not interchangeable.
A website attempting to meet both requirements may need:
Other US state laws
CCPA and CPRA are often used together because the CPRA amended the CCPA.
The CPRA introduced additional privacy protections and created the California Privacy Protection Agency.
Important changes included enhanced rights relating to sensitive personal information, correction, data minimisation, consumer privacy choices and other areas.
For current compliance purposes, businesses should generally evaluate the CCPA as amended by the CPRA, together with the applicable regulations.
CCPA compliance means implementing the legal, organisational and technical measures necessary to meet applicable CCPA requirements.
A compliance programme may include:
The CCPA regulations effective January 1, 2026 expanded the operational compliance landscape, including requirements related to risk assessments, cybersecurity audits and automated decisionmaking technology.
A CCPA privacy policy is a privacy notice that provides consumers with information required by applicable California privacy law.
Depending on the business and processing activities, it may explain:
The California Privacy Protection Agency states that covered businesses must provide consumers with disclosures about their privacy practices, including a privacy policy.
Businesses subject to the CCPA must provide appropriate methods for consumers to exercise their rights.
Depending on the right and business, mechanisms can include:
The applicable requirements differ depending on the request and business circumstances.
For example, the CPPA explains that businesses generally must provide at least two methods for certain requests to know, delete or correct, subject to specific exceptions.
A Data Subject Access Request (DSAR) is a general privacy-industry term for an individual's request to exercise certain data rights.
Under the CCPA, businesses more commonly refer to these as consumer requests rather than using GDPR terminology.
Depending on the situation, a consumer may request to:
A privacy-management system can help organisations receive, verify, route and document these requests.
The modern CCPA framework also includes requirements around purpose limitation and data minimisation.
The California Privacy Protection Agency explains that businesses must limit the collection, use and retention of personal information to purposes that meet the applicable statutory standards and are reasonably necessary and proportionate.
This means CCPA compliance is not only about providing a privacy link.
Businesses should also examine whether they collect and retain more personal information than is reasonably necessary for their disclosed purposes.
A practical CCPA website compliance checklist includes:
CCPA only works if a visitor's choice actually changes what your website does. ConsentX connects the two, so an opt-out is applied everywhere and not just recorded.
Detects GPC signals sent by the visitor's browser and treats them as a valid opt-out. See Global Privacy Control.
Adds a "Do Not Sell or Share My Personal Information" choice and remembers it on every visit.
Saves each visitor's choice with a timestamp, so you can show what was selected and when. See consent records.
Stops advertising and tracking scripts from running once a visitor has opted out. See prior-script blocking.
Finds the cookies, pixels and third-party scripts on your site, so you know which ones sell or share data. See xScan-AI.
Gives visitors one place to review and change their choices at any time. See the cookie consent banner.
Keeps proof of choices and signals in one place, ready if a regulator or customer asks.
Receives, verifies and tracks requests to know, delete or correct data. See DSAR management.
Applies CCPA rules to California visitors and GDPR rules to EU visitors automatically. See the Region Rule Engine.
The goal is to connect a consumer's privacy decision with the technical behaviour of the website.
For example, if a visitor opts out of the sale or sharing of personal information, the organisation needs an implementation that can carry that preference into the relevant processing and advertising technologies.
ConsentX provides tooling for CCPA/CPRA privacy preferences, GPC handling and consent records.
GPC is particularly important for automated privacy preference management.
Instead of requiring every consumer to manually locate an opt-out link on every website, a browser or user agent can communicate a qualifying privacy preference.
A privacy platform can then:
Detect the GPC signal.
Associate it with the applicable privacy preference.
Apply the relevant opt-out state.
Prevent or restrict applicable processing.
Maintain evidence of the preference where appropriate.
This turns privacy choice into an enforceable technical control rather than a purely informational disclosure.
The California Consumer Privacy Act (CCPA) is California's comprehensive consumer privacy law, as amended by the CPRA.
The key points are:
A "Do Not Sell or Share" link only counts if your website really stops sharing data when someone clicks it. With ConsentX you can:
Not sure where you stand? Scan your website free to see which trackers run on your site, or see how ConsentX handles CCPA compliance.
The European Union's comprehensive data-protection regulation.
The California Privacy Rights Act, which amended and expanded the CCPA.
An interface where users can review and change their privacy choices.
A CCPA privacy choice allowing consumers to opt out of applicable sale or sharing of personal information.
A category of information receiving additional protection under the CCPA.
A general privacy-industry term for requests to exercise applicable data rights.
A technical and legal concept generally associated with obtaining required consent before applicable non-essential processing occurs.
A browser or user-agent signal that communicates a consumer's privacy preference, including applicable CCPA opt-out requests.
Technology used to manage consent and privacy preferences across websites and digital properties.