The California Consumer Privacy Act does not require you to ask permission before setting cookies. That single fact trips up more website owners than almost any other privacy requirement, because it runs counter to the consent-first model that the GDPR made familiar across Europe.
California operates on an opt-out model. Cookies can load when a visitor arrives. But if those cookies collect personal information that gets sold or shared with third parties, the CCPA cookie requirements come into play:
- A "Do Not Sell or Share My Personal Information" link, or an equivalent opt-out, that works without extra steps.
- Honouring the Global Privacy Control (GPC) browser signal as an opt-out.
- Opt-in consent before selling or sharing the data of visitors you know are under 16.
- A privacy policy that discloses the cookies' categories of data and purposes.
California regulators have been penalising businesses that get this wrong since the Attorney General's Sephora settlement in 2022, and the California Privacy Protection Agency (CPPA) issued its own first fine in March 2025. As of October 2026, the published penalties run from $345,178 to $12.75 million.
How the CCPA defines personal information from cookies
Under Cal. Civ. Code Section 1798.140(v), personal information includes any data that identifies, relates to, or could reasonably be linked to a particular consumer or household. Cookies fall squarely within this definition when they store or transmit identifiers such as IP addresses, device fingerprints, browsing history or advertising IDs.
A session cookie that keeps a shopping cart alive does not raise the same issues as a _fbp pixel cookie that tracks a visitor across sites for retargeting. The first is strictly necessary. The second is almost certainly being shared with a third party, which triggers the CCPA's opt-out obligations.
Common cookies in regulated territory include _ga (Google Analytics), _fbp and fr (Meta), IDE and DSID (Google Ads), and any cross-site tracking script loaded by an advertising partner.
Opt-out, not opt-in: how the CCPA differs from the GDPR
This is the most important conceptual difference between the two frameworks. The ePrivacy Directive and the GDPR require websites to block all non-essential cookies until the visitor clicks "Accept". Under the CCPA, cookies can fire immediately. The full CCPA and GDPR comparison covers the differences beyond cookies.
What California demands instead is transparency and control after the fact. A business that sells or shares personal information collected via cookies must:
- Display a "Do Not Sell or Share My Personal Information" link on every page where personal information is collected, typically in the footer.
- Honour opt-out requests promptly and without adding unnecessary steps.
- Detect and respect the Global Privacy Control (GPC) browser signal as a valid opt-out request.
The CCPA also grants consumers the right to know what data has been collected, the right to delete it and the right to correct inaccurate records.
| Requirement | GDPR and ePrivacy | CCPA |
|---|---|---|
| Consent model | Opt-in (block before consent) | Opt-out (allow, then let visitors refuse) |
| Cookie banner required? | Yes, and it must block non-essential cookies | Not as such, but an opt-out link is required where data is sold or shared |
| GPC signal recognition | Not required by law | Required by the CCPA regulations since 29 March 2023 |
| Minors | Parental consent under 16 (varies by member state) | Opt-in required for under-16s, parental consent for under-13s |
| Fines | Up to 4% of global turnover or EUR 20 million | $2,663 per violation, $7,988 if intentional or involving minors |
| Enforcement body | National DPAs (CNIL, ICO and others) | CPPA and California Attorney General |
Who needs to comply
The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one threshold: annual gross revenue above $26,625,000 (the figure the CPPA set from 1 January 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households a year, or deriving 50% or more of annual revenue from selling or sharing personal information.
Location does not matter. A business registered anywhere in the world falls within scope if it processes California residents' data and crosses one of those thresholds.
What a CCPA cookie banner needs, and when you need one
The CCPA does not require a cookie banner as such. It requires the opt-out, the GPC handling and the disclosures, and a banner is often the most practical place to deliver them, especially if the same site also needs an opt-in banner for European visitors. Whether you need anything at all depends on what each cookie's data is used for.
What one cookie on your site asks of you under the CCPA
A cookie whose data stays with you, or with a service provider that may only use it for you under a contract, needs disclosure in your privacy policy but no opt-out. A cookie whose data a third party uses for its own purposes or for ads across sites is a sale or share, so it needs the opt-out link and GPC handling. If you know the visitor is under 16, that same cookie needs opt-in consent first.
If you do use a banner for California visitors, it has to follow the same rules as any other consent interface under the CCPA regulations: equal choices, no confusing wording and no tracking before a choice where opt-in is required.
The "Do Not Sell or Share" link
Since the CPRA amended the CCPA in 2023, the required link wording expanded to "Do Not Sell or Share My Personal Information". The word "share" covers cross-context behavioural advertising, a category that captures most third-party tracking cookies.
The link must be conspicuous on the homepage and any page collecting personal information. The regulations add that the number of steps to opt out of sale or sharing should be the same as, or fewer than, the steps to opt back in, and the CPPA devoted its September 2024 enforcement advisory to dark patterns.
Regulations effective 1 January 2026 added a further requirement. Businesses must show whether they have processed an opt-out preference signal. The regulations give an example: displaying "Opt-Out Request Honored" when a GPC-enabled visitor arrives, and a toggle in the visitor's privacy settings showing that they have opted out.
Global Privacy Control: the browser signal you must honour
The Global Privacy Control is a browser-level signal that automatically communicates a visitor's choice to opt out of the sale or sharing of personal data. According to the GPC project, Brave and DuckDuckGo turn it on by default, and Firefox offers it in its settings. California's Opt Me Out Act (AB 566), signed in October 2025, requires browsers to offer an opt-out preference signal setting from January 2027.
As of October 2026, 12 of the 19 US state privacy laws in force expect websites to honour universal opt-out signals. California, Colorado and Connecticut have confirmed that GPC qualifies, and a joint enforcement sweep announced on 9 September 2025 specifically targeted businesses failing to honour it.
The technical implementation is not complicated. GPC arrives as an HTTP header (Sec-GPC: 1) and as the navigator.globalPrivacyControl property in JavaScript. A consent management platform that supports GPC detects the signal and suppresses sale and sharing. If your CMP does not handle GPC, you will need server-side or JavaScript detection logic.
Dark patterns and banner design rules
The CPRA said that agreement obtained through dark patterns is not consent, and the CCPA regulations spell out what that means in practice:
- Closing or navigating away from a consent pop-up without selecting the equivalent of "I accept" does not count as consent, an example added on 1 January 2026.
- An opt-in prompt offering only "Yes" and "Ask me later" is not symmetrical, because it has no way to decline.
- The path to the more privacy-protective option must not be longer or harder than the path to the less protective one.
If your site serves visitors in both the EU and California, geo-targeted consent is the practical solution: show an opt-in banner to European visitors and an opt-out notice to Californians.
Recent enforcement: the CPPA is not bluffing
Enforcement has accelerated sharply since 2025, with the CPPA and the Attorney General both publishing cases.
American Honda was fined $632,500 in March 2025, partly because its online privacy management tool did not offer choices symmetrically. Todd Snyder paid $345,178 in May 2025 after its privacy portal left opt-out requests unprocessed for 40 days. Tractor Supply Company paid $1.35 million in September 2025, the largest fine in the CPPA's history, for an opt-out that did not work for GPC signals and for not properly informing consumers of their rights.
In 2026 the cases kept coming. Disney paid $2.75 million in February 2026 because opt-outs were not applied across the devices and services linked to an account. PlayOn Sports was fined $1.1 million in March 2026 for making visitors click "agree" to tracking before they could use their tickets and for ignoring opt-out preference signals. Ford Motor Company paid $375,703 the same month after requiring consumers to confirm their email address before processing opt-out requests. The regulations do not let a business require a verifiable consumer request for an opt-out of sale or sharing.
The largest penalty so far is the $12.75 million General Motors agreed to pay in May 2026 for selling drivers' data to data brokers, according to the Attorney General's list of enforcement actions. The full list, with dates and amounts, is in the guide to CCPA penalties and enforcement.
Sensitive personal information and minors
The CPRA introduced sensitive personal information (SPI) as a separate category covering precise geolocation, biometric data, health information and financial details. Businesses using SPI beyond what is needed for the expected service must provide a "Limit the Use of My Sensitive Personal Information" link.
For minors, the rules flip to opt-in. Businesses with actual knowledge that a consumer is under 16 must obtain affirmative consent before selling or sharing that person's data. For children under 13, a parent or guardian must provide the consent. After any consumer opts out of sale or sharing, the business must wait at least 12 months before asking them to opt back in.
Six steps to meet the CCPA cookie rules
Step 1: Audit your cookies
Run a cookie scan to identify every cookie on your site, who sets it and what data it collects. Focus on third-party cookies from advertising networks, analytics platforms and social media embeds.
Step 2: Classify by purpose
Sort cookies into categories: strictly necessary and non-essential (analytics, marketing, personalisation). Any cookie collecting data that is sold or shared triggers opt-out obligations.
Step 3: Add the required links
Place a "Do Not Sell or Share My Personal Information" link in your website footer and on any page that collects personal information.
Step 4: Implement GPC detection
Configure your CMP or add server-side logic to detect the Sec-GPC: 1 header. When it is detected, suppress sale and sharing and show that the signal was processed, for example with a message such as "Opt-Out Request Honored".
Step 5: Update your privacy policy
Disclose which categories of personal information you collect, the purposes for collection, and how consumers can exercise their rights. California's 2026 regulations also require mobile apps to link to the privacy policy from the app's settings menu.
Step 6: Keep records
Log opt-out requests and how you responded. The CCPA regulations require businesses to keep records of consumer requests and how they responded, and a log is what you can show if a regulator asks how a request was handled.
Short answers on CCPA cookie consent
Does the CCPA require a cookie consent banner?
Not in the way the GDPR does. The CCPA does not mandate a pop-up banner that blocks cookies before consent. It requires a "Do Not Sell or Share My Personal Information" link where data is sold or shared, and the ability to honour opt-out requests, including GPC signals. Many businesses use a banner to deliver these, but California law does not require one as such.
Can I set analytics cookies without asking California visitors first?
Yes, the CCPA allows cookies to load before consent. But if the analytics data is shared with third parties for their own purposes, such as advertising, the visitor must be able to opt out of that sharing. Analytics run by a provider acting as your service provider, for your own site only, is usually not a sale or share.
What happens if my website ignores GPC signals?
Failing to honour GPC signals is a CCPA violation. The CPPA fined Tractor Supply Company $1.35 million in 2025 and PlayOn Sports $1.1 million in 2026 partly for this failure, and California, Colorado and Connecticut announced a joint sweep in September 2025 targeting businesses that did not honour GPC. Fines are assessed per violation at up to $2,663, or $7,988 for intentional violations.
Do I need CCPA compliance if my business is outside California?
Yes, if you collect personal information from California residents and meet the revenue or data-volume thresholds. The CCPA applies based on where the consumer lives, not where the business is incorporated. Ford Motor Company, headquartered in Michigan, was fined $375,703 in March 2026 for CCPA opt-out violations.
How is the CCPA different from the CPRA?
The CPRA is an amendment to the CCPA, not a separate law. It expanded the original act by introducing "sharing" (covering cross-context behavioural advertising), creating the CPPA as a dedicated enforcement agency, adding sensitive personal information protections, and stating that agreement obtained through dark patterns is not consent. All CPRA provisions are now part of the CCPA.
Can I use the same cookie banner for GDPR and CCPA visitors?
You can, but it is not ideal. The GDPR requires opt-in consent that blocks cookies before acceptance. The CCPA requires opt-out controls. Showing a full opt-in banner to California visitors adds friction and reduces analytics data. The common approach is geo-targeted consent: opt-in for EU and UK visitors and opt-out for California visitors.
What are the current CCPA fine amounts for cookie violations?
As of October 2026, fines are up to $2,663 per violation and $7,988 per intentional violation or violation involving minors' data. The CPPA set these amounts from 1 January 2025, and the next inflation adjustment is due in January 2027. Consumers can also seek statutory damages of $107 to $799 per consumer per incident in data breach cases.
Check what your cookies share with third parties
If your website collects data from California visitors through tracking cookies, the CCPA's opt-out requirements apply. Kukie.io scans your site for cookies and categorises them, blocks tracking scripts until visitors choose where you need opt-in, and can treat a GPC signal as an opt-out in the regions where you use an opt-out model.
