The California Consumer Privacy Act (CCPA) is an opt-out law: a covered business must tell California visitors what it collects, let them refuse the sale or sharing of their personal information, honour browser opt-out signals such as Global Privacy Control, and since 1 January 2026 show visitors that their opt-out was processed. This guide covers what those rules mean for a website. For the law's background, rights and history, read what the CCPA is.
The law behind the website rules
The CCPA protects the privacy rights of California residents by giving them control over how businesses collect and use their personal data. It first took effect in 2020 and was expanded by the California Privacy Rights Act (CPRA), which introduced stricter requirements and created a dedicated enforcement agency, the California Privacy Protection Agency (CPPA). On 23 September 2025, the CPPA announced the approval of new regulations on cybersecurity audits, risk assessments and automated decision-making technology, which took effect on 1 January 2026 with later deadlines for some parts.
The CCPA follows the consumer, not the business's address. If your website collects data from people living in California, you may be subject to these rules regardless of where your company is based. Understanding how the CCPA treats cookies matters for any business with a national or international digital presence.
Which businesses must comply
Not every small website or personal blog falls under the scope of the CCPA. The law targets for-profit entities that do business in California and meet specific financial or data-volume thresholds. Since the inflation adjustment of 1 January 2025, a business is covered if it meets any one of these three criteria:
- Annual revenue: your business had gross annual revenue above $26,625,000 in the preceding calendar year.
- Data volume: you annually buy, sell or share the personal information of 100,000 or more California residents or households.
- Revenue from sales: you derive 50% or more of your annual revenue from selling or sharing California residents' personal information.
It is a common misconception that only data brokers are affected. If you run a high-traffic e-commerce site or a media platform that uses marketing cookies to share data about 100,000 California visitors a year, you can meet the data volume threshold even if your revenue is below the $26.6 million mark.
What counts as personal information
The CCPA uses a broad definition of personal information. It includes any data that identifies, relates to or could reasonably be linked to a particular consumer or household. This goes far beyond names and email addresses.
| Category | Examples of data collected |
|---|---|
| Identifiers | Real name, alias, postal address, unique personal identifier, IP address, email, account name |
| Commercial information | Records of personal property, products or services purchased, obtained or considered |
| Internet activity | Browsing history, search history, and information about a consumer's interaction with a website or advertisement |
| Geolocation data | Physical location, often via mobile apps or browser APIs |
| Sensitive personal information | Social Security number, driver's licence, precise geolocation, racial or ethnic origin, genetic data, neural data |
Since 1 January 2026, section 7001 of the CCPA regulations also counts the personal information of consumers a business knows to be under 16 as sensitive personal information, and willfully disregarding a consumer's age counts as knowing it. When you define your cookie categories, account for these data types.
Where the CPRA changed your website
Many people use the two names interchangeably, but the CPRA was a 2020 ballot initiative that amended and expanded the original CCPA (see the CCPA and CPRA differences). It added the "sharing" of personal information to the law's scope, which targets cross-context behavioural advertising, and it created the CPPA, the first state agency in the US dedicated solely to privacy enforcement.
The CPRA also introduced the right to correct inaccurate personal information and the right to limit the use of sensitive personal information. If you process sensitive data for purposes beyond what is needed to provide the service requested, your website needs a "Limit the Use of My Sensitive Personal Information" link.
What your website has to show
The CCPA's website duties come down to a few visible elements. A covered site needs:
- A notice at collection, at or before the point where personal information is collected, naming the categories and purposes
- A privacy policy that lists the categories of information you collect, the purposes, and how visitors can exercise their rights
- A "Do Not Sell or Share My Personal Information" link if you sell personal information or share it for cross-context behavioural advertising (the CCPA opt-out requirements cover the wording and placement)
- A "Limit the Use of My Sensitive Personal Information" link where the right to limit applies
- Support for opt-out preference signals such as Global Privacy Control
- A way for visitors to confirm that their opt-out was processed
The last two changed with the 2026 regulations. Section 7025 now says a business "must display whether it has processed the consumer's opt-out preference signal" as a valid opt-out, for example with a message on the page or a toggle showing the visitor has opted out. Section 7026 adds that a business must provide a means for the consumer to confirm their opt-out request was processed.
In practice, a site that sees a Global Privacy Control (GPC) signal must treat it as a request to opt out of sale and sharing, stop the advertising tags that sell or share data, and tell the visitor it did so. The guide to honouring GPC signals covers the detection side.
The regulations also ban choice architecture that steers people. An opt-out that takes more steps than opting in, a confusing toggle or a button hidden in fine print is a dark pattern under the CCPA, and the agency has said so in enforcement advisories. The CCPA's 2026 dark pattern rules go through the design side in detail.
Cybersecurity audits from 2028
The 2026 regulations introduced mandatory cybersecurity audits for businesses whose processing presents a significant risk to consumers' security. Under section 7120, that covers businesses that make 50% or more of their revenue from selling or sharing personal information, and businesses above the revenue threshold that processed the personal information of 250,000 or more consumers, or the sensitive personal information of 50,000 or more, in the preceding year.
The first deadlines depend on revenue. A business with more than $100 million in 2026 revenue must complete its first audit, covering 2027, by 1 April 2028. Businesses between $50 million and $100 million follow on 1 April 2029, and those under $50 million on 1 April 2030.
The audit report itself is not filed with the regulator. Under section 7124, the business submits a written certification to the CPPA, signed by a member of executive management, that the audit was completed. Risk-assessment attestations and summaries are due by 1 April 2028, and the rules on automated decision-making technology apply from 1 January 2027.
Enforcement and fines
Since 1 January 2025, fines under the CCPA can reach $2,663 per violation, or $7,988 for each intentional violation or violation involving consumers the business knows to be under 16. Because fines apply per violation, a non-compliant cookie banner on a high-traffic site can add up quickly. The CCPA penalties guide explains how they are counted.
Both enforcers have been busy, and most cases turned on opt-outs that did not work:
- Todd Snyder (CPPA, 6 May 2025): $345,178 for a privacy portal that failed to process opt-out requests for 40 days, asked for more information than needed, and made consumers verify their identity before opting out.
- Healthline Media (Attorney General, 1 July 2025): $1.55 million over tracking on a health website, including failing to let consumers opt out of targeted advertising.
- Tractor Supply (CPPA, 30 September 2025): $1.35 million, the largest fine in the agency's history at the time, partly for a privacy policy that did not tell consumers about their rights.
- Disney (Attorney General, 11 February 2026): $2.75 million for not fully applying opt-out requests across its streaming services.
- General Motors (Attorney General, 8 May 2026): $12.75 million for selling OnStar driving and location data.
As of October 2026, General Motors' settlement is the largest CCPA penalty listed on the Attorney General's privacy enforcement page.
How website owners can meet the rules
Start with transparency and visitor choice. Publish a clear privacy policy that lists the categories of information you collect and the purposes for which you use them. If you use third-party marketing or advertising tags that sell or share data, add the "Do Not Sell or Share My Personal Information" link.
Next, find out what your site actually loads. A cookie scan shows which third-party scripts are active, so you know which ones must stop when a visitor opts out or sends a GPC signal.
While the CCPA shares some ideas with Europe's GDPR and other privacy laws, it works differently. The CCPA is primarily an opt-out system for most adults, whereas the GDPR is a prior-consent system. For consumers under 16 in California, the CCPA works as an opt-in system: selling or sharing their data needs affirmative consent first, from a parent for children under 13.
CCPA questions from website owners
Does the CCPA apply to businesses outside California?
Yes. If your business is for-profit, does business in California, and meets the revenue or data volume thresholds, you must comply regardless of where your headquarters are located.
What is the difference between selling and sharing data?
Selling involves the exchange of personal information for money or other valuable consideration. Sharing means disclosing data to a third party for cross-context behavioural advertising, even if no money changes hands.
Do I need a cookie banner for CCPA?
The CCPA does not require a GDPR-style consent banner for adult visitors. You must give a notice at collection, a clear way to opt out of sale and sharing, and honour opt-out preference signals, and a consent tool is a practical way to handle all three.
What are dark patterns in the context of CCPA?
Dark patterns are interface designs that steer or confuse people into choices they did not intend, such as an opt-out button that is far harder to find than the accept button. Consent obtained through a dark pattern does not count under the CCPA regulations.
Can I be fined if I don't have a California office?
Yes. The California Attorney General and the CPPA can take enforcement action against any covered business that processes the personal information of California residents, wherever the business is based.
Do I have to show visitors that their opt-out worked?
Yes, since 1 January 2026. The CCPA regulations require a business to display whether it processed an opt-out preference signal and to give consumers a way to confirm that their opt-out request was processed.
See which scripts your California opt-out must stop
If you are unsure what your website loads for California visitors, start by checking. Kukie.io scans your site for tracking technologies, applies the consent model you set for each region, and treats a GPC signal as an opt-out where you use an opt-out model.
