The California Consumer Privacy Act (CCPA) is California's privacy law: it gives residents the right to know, delete and correct the personal information businesses hold about them, to opt out of its sale or sharing, and to limit the use of sensitive data. For a website, it means a "Do Not Sell or Share My Personal Information" opt-out, honouring the Global Privacy Control (GPC) browser signal, and a privacy policy that lists what you collect. It applies to for-profit businesses that meet one of three thresholds, wherever they are based.
The CCPA in plain terms
The CCPA is a state-level privacy law that grants California residents specific rights over their personal information. Signed into law in 2018 and effective from January 2020, it was the first comprehensive privacy statute in the United States. California voters then approved Proposition 24 in November 2020, which introduced the California Privacy Rights Act (CPRA) - an amendment that expanded consumer rights and created a dedicated enforcement agency, the California Privacy Protection Agency (CPPA).
The CPRA is not a separate law. It amends the CCPA, and the California Attorney General's office typically refers to the combined legislation as "CCPA" or "CCPA, as amended."
As of October 2026, 19 US states have comprehensive privacy laws in force. The CCPA remains the most influential and the most heavily enforced. If your website collects data from California residents, the rules below likely apply to you - even if your business is based in another state or another country entirely.
Who must comply with the CCPA
The CCPA applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds. On 1 January 2025, the California Privacy Protection Agency adjusted the revenue threshold for inflation:
| Threshold | Requirement |
|---|---|
| Annual gross revenue | Exceeds $26,625,000 (previously $25 million) |
| Data volume | Buys, sells, or shares the personal information of 100,000 or more California consumers or households annually |
| Revenue from data sales | Derives 50% or more of annual revenue from selling or sharing personal information |
You only need to meet one of these. Crucially, the law is extraterritorial - it protects California residents regardless of where the business processing their data is located. A marketing agency in London or an e-commerce shop in Berlin that serves Californian customers can fall within scope.
Consumer rights under the CCPA
The CCPA, as amended by the CPRA, grants California residents a set of rights that have been expanding since the law first took effect. These rights apply to any personal information a business has collected, whether through cookies, forms, purchase history, or any other channel.
The core rights
Residents can request to know what categories of personal information a business collects and how that data is used or shared. They can ask for the specific pieces of data a business holds about them. Deletion requests require businesses to erase collected personal information, subject to certain exceptions such as legal obligations or ongoing transactions. Since the CPRA amendments, consumers can also request corrections to inaccurate personal information.
The right to opt out of the sale or sharing of personal information is central to how the CCPA affects websites. Any business that sells personal data - or shares it for cross-context behavioural advertising - must provide a clear mechanism for consumers to say no.
Two additional CPRA-era rights round out the framework: the right to limit how businesses use and disclose sensitive personal information (such as precise geolocation, financial data, or health information), and the right to non-discrimination, which prevents businesses from penalising consumers who exercise their privacy rights.
The CCPA differs from the GDPR on consent
Website owners who already comply with the EU's GDPR sometimes assume they are covered for California too. That assumption is risky. The two laws share goals but differ in mechanics.
The GDPR requires opt-in consent before setting non-essential cookies. A visitor to your site must actively agree before analytics or advertising scripts fire. The CCPA takes the opposite approach: an opt-out model. Businesses can collect personal information without asking first, but they must give consumers the ability to stop the sale or sharing of that data after the fact.
This means the CCPA does not require a cookie consent banner in the way the GDPR does. What it does require is a conspicuous "Do Not Sell or Share My Personal Information" link, typically placed in the website footer and optionally within a cookie notice. If a visitor clicks that link and opts out, all cookies and tracking technologies involved in selling or sharing data must stop for that user.
Practical implications for your cookie setup
If you serve both European and Californian visitors, the simplest approach is to use a consent management platform (CMP) that supports both opt-in and opt-out models with geo-detection. European visitors see an opt-in banner that asks before cookies load. Californian visitors see an opt-out notice with a "Do Not Sell or Share" link. Kukie.io's geo-targeting applies the region rules you set, so each visitor sees the banner model you chose for their location.
What counts as selling or sharing cookie data
The word "sell" under the CCPA is broader than you might expect. It covers any exchange of personal information for monetary or other valuable consideration. If your website drops a third-party advertising cookie - say, _fbp from Meta or a Google Ads remarketing tag - and that cookie transmits browsing data to the third party, the CCPA may classify this as a sale or share of personal information.
The CPRA introduced the concept of "sharing," which specifically targets cross-context behavioural advertising. Even if no money changes hands, passing a consumer's browsing data to an ad network for targeted advertising constitutes sharing and triggers opt-out obligations.
First-party analytics cookies like _ga from Google Analytics generally do not count as selling or sharing, provided the data stays within your control and is not passed to third parties for their own purposes. But the moment a third-party script accesses that data or sets its own cookies to build consumer profiles, the calculus changes.
Global Privacy Control is an opt-out you must honour
Global Privacy Control (GPC) is a browser-level signal that tells websites a visitor wants to opt out of the sale and sharing of their personal information. Under the CCPA, honouring this signal is not optional - it is a legal requirement.
GPC is supported natively in Brave and DuckDuckGo (on by default) and in Firefox (in its settings). Other browsers rely on extensions such as Privacy Badger. That is about to change. On 8 October 2025, Governor Newsom signed the Opt Me Out Act (AB 566), which from 1 January 2027 requires businesses covered by the CCPA that develop or maintain a browser to offer a setting that sends an opt-out preference signal.
Regulators have already shown they take GPC seriously. The very first CCPA enforcement action, in August 2022, resulted in a $1.2 million fine against Sephora - partly for failing to honour GPC signals. In September 2025, the CPPA, the California Attorney General, and attorneys general from Colorado and Connecticut launched a joint investigative sweep targeting businesses that ignore GPC.
Your CMP must be configured to detect the Sec-GPC HTTP header (sent with a value of 1) and treat it as a valid opt-out request. When the signal is detected, all cookies and scripts that facilitate data sales or sharing should be suppressed for that visitor - no banner interaction required. If a visitor's GPC signal conflicts with a setting on your site that allows selling or sharing, the CCPA regulations say you must process the signal as an opt-out, though you may tell the visitor about the conflict and ask whether they consent. Since 1 January 2026, you must also show that the signal was processed.
Who enforces the CCPA, and the fines so far
Two bodies enforce the CCPA. The California Attorney General's office has been active since the law took effect in 2020. The California Privacy Protection Agency (CPPA), created by the CPRA, began enforcement in early 2024 after a legal challenge over timing was resolved by a California appellate court in February 2024.
Since then, both agencies have stepped up their enforcement, and both publish their actions: the Attorney General on its list of privacy enforcement actions, the CPPA in its announcements.
Recent enforcement actions
The fines are growing. In March 2025, the CPPA issued its first fine, $632,500 against American Honda Motor Co. According to the CPPA's announcement, Honda's online privacy management tool did not offer privacy choices in a symmetrical way, and Honda asked for too much information before letting people opt out.
That Honda decision matters for every website owner. Where a cookie tool offers "Allow All", it must offer an equally easy way to refuse. That is a rule about symmetry, not a requirement to get opt-in consent before cookies load.
In September 2025, the CPPA issued what was then the largest fine in its history: $1.35 million against Tractor Supply Company for several CCPA violations, including failing to honour GPC signals. In March 2026, it fined PlayOn Sports $1.1 million, partly for an "agree" wall and ignored opt-out signals, and Ford $375,703 for requiring an email check before an opt-out.
The California AG has also been busy. A $1.55 million settlement with Healthline Media in July 2025 targeted failures to honour opt-out requests and the sharing of data that could reveal readers' health conditions with advertisers. In February 2026, the AG secured $2.75 million from Disney over opt-outs its streaming services applied only to one service or device. In May 2026, a settlement with General Motors over the sale of drivers' location and driving data set the record at $12.75 million.
Current penalty amounts
| Violation type | Maximum fine per violation (from 1 January 2025) |
|---|---|
| Unintentional violation | $2,663 |
| Intentional violation or one involving a known minor under 16 | $7,988 |
| Consumer damages (per consumer, per incident) | $107 to $799 |
As of October 2026, these are the current CCPA fines. The amounts adjust every other year for inflation, and the next adjustment is due in January 2027. Unlike most other state privacy laws, the CCPA also lets consumers sue businesses directly after certain data breaches affecting their personal information.
Symmetry of choice and dark patterns
California's CCPA regulations prohibit dark patterns - user interface designs that manipulate or trick consumers into giving up their privacy rights. Section 7004(a)(2) of the CCPA regulations requires businesses to offer "symmetry of choice," meaning that selecting the most privacy-protective option must not be harder or more time-consuming than selecting the least privacy-protective one.
A cookie banner with "Accept All" and "More Information" as the only two buttons would likely fail this test. The privacy-protective path (rejecting cookies) requires extra steps, while acceptance is a single click. The Honda enforcement action confirmed this interpretation in practice.
For your cookie banner, this means:
- If you offer an "Accept All" button, you should also offer a "Reject All" or "Decline All" button at the same level of prominence.
- Opt-out mechanisms should require no more steps than opt-in.
- Do not use confusing language, double negatives, or pre-selected toggles that default to data sharing.
What the CCPA requires on your website
Compliance is not just about having the right cookie banner. The CCPA imposes several specific obligations that affect how your website collects, stores, and communicates about personal information.
Privacy policy
Your privacy policy must list the categories of personal information collected in the past 12 months, the purposes for collection, whether you sell or share data, and the categories of third parties receiving that data. It must describe each consumer right and explain how visitors can exercise them. The policy should be updated at least annually and include the date of the last revision.
Notice at collection
Before or at the point of data collection, you must inform visitors what categories of information you are collecting and why. This notice should be concise, accessible, and separate from your full privacy policy - though it can link to it.
Do Not Sell or Share link
If your website sells or shares personal information (including through advertising cookies or third-party trackers), you must display a clear, conspicuous link labelled "Do Not Sell or Share My Personal Information" on your homepage and ideally in your footer on every page. Clicking this link should allow the visitor to opt out without creating an account or verifying their identity.
Responding to consumer requests
Businesses must acknowledge consumer requests within 10 business days and fulfil them within 45 calendar days. When a consumer opts out of sales or sharing, that decision must be respected for at least 12 months before the business can ask them to reconsider.
Beyond California: the US privacy patchwork
California started the trend, but it is no longer alone. As of October 2026, 23 states have enacted comprehensive privacy laws and 19 are in force: Indiana, Kentucky and Rhode Island took effect on 1 January 2026, and Oklahoma, Alabama, Louisiana and Vermont, the 23rd, passed theirs in 2026 to take effect between 2027 and 2028. States like Colorado, Connecticut, and Texas are actively enforcing their own privacy statutes, and many of these laws explicitly require businesses to honour universal opt-out mechanisms like GPC.
As of October 2026, there is no federal comprehensive privacy law. The American Privacy Rights Act of 2024 stalled in Congress, and in April 2026 the CPPA opposed the SECURE Data Act, a federal bill that would pre-empt state privacy laws. For website owners, this means building a compliance strategy that can adapt across jurisdictions - not one that treats California as a one-off exception.
A consent management platform that supports geo-targeted banners, GPC signal detection and cookie categorisation lets one site follow several frameworks, and the overview of global privacy laws shows which model each region uses. Kukie.io's cookie scanner lists the first-party and third-party cookies on your site and sorts them by category, which is where any of these laws starts.
How to prepare your website for the CCPA
Start by understanding what your website actually does. Run a cookie scan to identify every cookie and tracking script. Categorise them: strictly necessary, functional, analytics, or advertising. Determine which ones involve data being sent to third parties - those are the ones that trigger CCPA obligations.
Update your privacy policy to include all CCPA-required disclosures. Add a "Do Not Sell or Share My Personal Information" link to your website footer. Configure your CMP to detect GPC signals and suppress non-essential cookies when the signal is present.
If you serve visitors from multiple US states, check whether other state privacy laws apply to you. Many share similar opt-out requirements but differ in thresholds and definitions. A scalable CMP that handles geo-targeting will save you from maintaining separate compliance configurations for each jurisdiction.
Document everything. The CCPA regulations require businesses to keep records of consumer requests and how they responded (section 7101), and the Tractor Supply decision required a corporate officer to certify compliance every year for four years. If an investigation comes, those records are your first line of defence.
Questions about the CCPA
Does the CCPA require a cookie consent banner?
Not in the way the GDPR does. The CCPA requires a "Do Not Sell or Share My Personal Information" link and a notice at collection, but it does not require a pop-up consent banner. Where a cookie tool does offer choices, the CPPA's Honda decision shows they must be symmetrical, so refusing must be as easy as accepting.
What is the difference between the CCPA and the CPRA?
The CPRA is an amendment to the CCPA, not a separate law. It was approved by California voters in November 2020 and took effect on 1 January 2023. The CPRA expanded consumer rights (adding correction and limiting use of sensitive data), created the California Privacy Protection Agency, and introduced concepts like "sharing" for cross-context behavioural advertising.
Can I be fined under the CCPA if my business is not in California?
Yes. The CCPA applies to any for-profit business that meets the applicability thresholds and collects personal information from California residents. Physical location does not matter: a company in New York, London, or Sydney can face CCPA enforcement if it processes Californian consumers' data.
What happens if my website ignores Global Privacy Control signals?
Ignoring GPC signals is a CCPA violation. The California AG's Sephora settlement in 2022 was partly for this failure, and the CPPA fined Tractor Supply $1.35 million in 2025 and PlayOn Sports $1.1 million in 2026 in part for it. From 1 January 2027, the Opt Me Out Act requires browser makers covered by the CCPA to offer an opt-out signal setting.
Do analytics cookies like Google Analytics fall under the CCPA?
First-party analytics cookies generally do not count as selling or sharing personal information, provided the data remains under your control. However, if your Google Analytics implementation sends data to Google in a way that Google can use for its own purposes, or if you have enabled data sharing features, the data transfer may be classified as sharing under the CCPA.
How much can the CCPA fine per violation?
As of October 2026, the maximum is $2,663 per violation and $7,988 per intentional violation or one involving a known minor under 16, amounts set from 1 January 2025. Consumers can also claim statutory damages of $107 to $799 per person, per incident, in private lawsuits related to data breaches.
Is the CCPA opt-in or opt-out for cookies?
The CCPA follows an opt-out model. Businesses can collect personal information without prior consent, but must allow consumers to opt out of data sales and sharing. The exception is minors: a business must get opt-in consent before selling or sharing the personal information of consumers it knows are at least 13 and under 16, and parental consent for children under 13.
Find out what your site shares before a California visitor asks
If your site uses advertising trackers, analytics scripts or other third-party cookies that share data, the CCPA's opt-out duties apply once you meet a threshold. Kukie.io scans your site to show what it sets, can show a "Do Not Sell or Share" choice in the regions you choose, and can treat a GPC signal as an automatic opt-out.
