CCPA consumer rights give California residents six rights over their personal information: to know what a business collects, to delete it, to opt out of its sale or sharing, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for using any of these. For a website, three of them shape the interface directly: the opt-out link and Global Privacy Control (GPC), the limit link for sensitive data, and the request forms for the rest. How cookies fit into this is covered in the guide to CCPA cookie consent.
California privacy rights in 2026
The California Consumer Privacy Act (CCPA) gave residents significant control over their personal information, and the California Privacy Rights Act (CPRA) amendments added the rights to correct and to limit from 1 January 2023. New CCPA regulations from the California Privacy Protection Agency (CPPA) took effect on 1 January 2026, and they make some website requirements more technical. A privacy policy alone is not enough: the interface has to work for a visitor in real time.
Regulators have moved from education to enforcement. The CPPA issued its first fine in March 2025, $632,500 against Honda, and has fined Todd Snyder, Tractor Supply, PlayOn Sports and Ford since. The sections below take each right in turn, then the enforcement record and the interface it implies.
1. The right to know
The right to know allows California residents to request details about the personal information a business collects, uses, and shares. This includes the categories of information, the sources from which it was collected, the business purpose for the collection, and the specific third parties who received that data.
A request covers the 12 months before the business receives it, but a consumer may ask for older information collected on or after 1 January 2022, and the business must provide it unless that proves impossible or would involve disproportionate effort. Your website must provide a clear mechanism, such as a dedicated email address or a web form, for users to submit these verifiable consumer requests.
2. The right to delete
Users have the right to request the deletion of personal information collected from them. When you receive a valid deletion request, you must delete the information from your records and direct your service providers to do the same. This is particularly relevant for marketing databases and tracking logs generated by cookie categories like marketing and analytics.
However, the right to delete is not absolute. You may retain data if it is necessary to complete a transaction, detect security incidents, or comply with a legal obligation. Verification for a deletion request must be proportionate to the sensitivity of the data involved. Opt-outs are stricter still: in May 2025, the CPPA fined Todd Snyder $345,178 partly for requiring consumers to verify their identity before they could opt out.
3. The right to opt out of sale or sharing
One of the most visible requirements for website owners is the right to opt out. California law distinguishes between "selling" (exchanging data for money or other valuable consideration) and "sharing" (transferring data for cross-context behavioural advertising). Most websites that use third-party marketing pixels are "sharing" data.
To meet it, your website must feature a clear and conspicuous link titled "Do Not Sell or Share My Personal Information", or an equivalent opt-out, and must treat a Global Privacy Control (GPC) signal as a valid opt-out. Honouring opt-out preference signals has been required since the CCPA regulations took effect on 29 March 2023. Since 1 January 2026, the regulations also require you to show that the request was processed, for example with a message on the site or a toggle in the visitor's privacy settings showing they have opted out.
An opt-out must take effect as soon as feasibly possible, and no later than 15 business days after you receive it.
| Requirement | In force since | What it means on your site |
|---|---|---|
| "Do Not Sell or Share My Personal Information" link | 1 January 2023 (CPRA) | A link or equivalent opt-out on pages where you collect personal information |
| Honour GPC as an opt-out | 29 March 2023 (CCPA regulations) | Stop selling and sharing when the browser sends the signal |
| Symmetry of choice | 29 March 2023 (CCPA regulations) | Refusing must be as easy as accepting |
| Confirm the opt-out was processed | 1 January 2026 | A visible message or a privacy-settings toggle showing the opt-out |
4. The right to correct
The right to correct inaccurate personal information was introduced by the CPRA. If a consumer identifies that the data you hold about them is incorrect, they can request a correction. Website owners must use commercially reasonable efforts to update the data across their systems and notify any service providers who process that data on their behalf.
For websites, this often means making user profile sections editable or providing a clear path for users to submit correction requests. Inaccurate data becomes a bigger risk when it feeds automated decisions or financial profiling.
5. The right to limit the use of sensitive personal information
The CCPA creates a subset called sensitive personal information (SPI). This includes precise geolocation, racial or ethnic origin, religious beliefs, biometric data used to identify someone, and health information, and since 1 January 2026 the regulations add personal information of consumers you know are under 16. If your website uses or discloses SPI for purposes beyond those the regulations allow, such as providing the service the visitor asked for, you must provide a "Limit the Use of My Sensitive Personal Information" link.
A realistic trigger is precise geolocation: location from the browser's Geolocation API or a mobile SDK, accurate to within 1,850 feet, used to target ads. City-level location from an IP address does not reach that standard. If you use precise location to build a profile or for advertising, visitors must be able to restrict that use to what the service needs.
6. The right to non-discrimination
You cannot discriminate against a user for exercising their privacy rights. This means you cannot deny goods or services, charge different prices, or provide a lower quality of service because a user opted out of tracking or requested data deletion.
You can offer financial incentives for data collection, such as a discount code for signing up to a newsletter, but the visitor has to opt in to the programme, and you must explain its terms.
More rights from 2027: automated decision-making
The regulations approved in September 2025 add rules for automated decision-making technology used to make significant decisions about consumers. From 1 January 2027, businesses that use it for those decisions must give consumers a pre-use notice, a way to opt out in most cases and a way to access information about the technology. Ordinary website analytics and behavioural advertising are outside that scope in the final rules.
How enforcement is changing
In July 2025, the California Attorney General announced a $1.55 million settlement with Healthline Media. The investigation found that the publisher failed to let consumers opt out of targeted advertising, shared data with third parties without the contract terms the CCPA requires, and ran a consent banner that did not disable tracking cookies when a visitor unchecked a box. Healthline shows that the Attorney General checks whether consent tools actually stop data transmission as promised.
The CPPA has pursued the same theme. Honda ($632,500, March 2025) used a privacy tool that did not offer choices symmetrically. Tractor Supply ($1.35 million, September 2025) failed to honour opt-out preference signals such as GPC. PlayOn Sports ($1.1 million, March 2026) forced users to click "agree" to tracking, and Ford ($375,703, March 2026) required an email check before an opt-out. The Attorney General's settlements with Disney ($2.75 million, February 2026) and General Motors ($12.75 million, May 2026) followed.
The regulations also prohibit dark patterns that make the opt-out process harder than accepting. Choices must be symmetrical: if your "Accept All" button is large and colourful, your "Reject All" or "Opt-Out" button must be equally prominent.
What the interface needs
To support these rights, your website needs more than a privacy policy. Check that:
- The "Do Not Sell or Share" link is easy to find on every page that collects personal information.
- Advertising and sharing scripts stop once a visitor opts out or their browser sends GPC.
- The site shows visitors that their opt-out was processed.
- Visitors you know are under 16 opt in before you sell or share their data.
- Visitors can reach every right through your privacy policy or a request form.
A consent management platform can detect California visitors and show the right links and notices for that region.
Questions about CCPA consumer rights
Does the CCPA apply to my website if I am not based in California?
Yes, the CCPA applies to any for-profit business that does business in California and meets the revenue or data processing thresholds, regardless of where the company is headquartered. If you serve California residents and meet a threshold, the law applies.
What is the difference between selling and sharing data?
Selling involves transferring personal information to a third party for monetary or other valuable consideration. Sharing refers specifically to the transfer of personal information for cross-context behavioural advertising, which is how most marketing cookies operate.
Do I need a Do Not Sell or Share link if I don't sell data?
Many businesses do not sell data in the traditional sense, but if you use third-party advertising pixels (like Meta or Google Ads), you are likely sharing data under California law and need to offer the opt-out.
What are dark patterns in CCPA terms?
Dark patterns are user interface designs that subvert or impair user choice. Examples include making the Reject All button hard to find, using confusing language, or requiring more clicks to opt out than to opt in. Agreement obtained through a dark pattern does not count as consent.
How long do I have to respond to a CCPA request?
You must respond to a request to know, delete or correct within 45 calendar days. An opt-out of sale or sharing must take effect as soon as feasibly possible and no later than 15 business days after you receive it.
Is honouring Global Privacy Control mandatory?
Yes. Honouring GPC as an opt-out of sale or sharing has been required since the CCPA regulations took effect on 29 March 2023. Since 1 January 2026, you must also show that the signal was processed.
Check how your site handles California visitors
If you are not sure how your website responds to a California opt-out, start by finding out what it loads. Kukie.io scans your site for cookies and trackers, can show a "Do Not Sell or Share" choice to visitors in the regions you set, and can treat a GPC signal as an automatic opt-out.
