CCPA and CPRA: cookie rules for California visitors

What are the CCPA and the CPRA?

The California Consumer Privacy Act (Civil Code section 1798.100 and following) was passed in 2018 and has applied since 1 January 2020. The California Privacy Rights Act, approved by voters as Proposition 24 in November 2020, amended it with effect from 1 January 2023: it added the concept of sharing for advertising, the right to limit sensitive data, and created the California Privacy Protection Agency, the first dedicated privacy regulator in the United States. The Agency's regulations took effect on 29 March 2023, and an updated set, including a duty to show whether an opt-out signal was honored, applies since 1 January 2026.

Who does it apply to?

The law covers for-profit businesses that do business in California and meet one of three thresholds, adjusted for inflation every two years: annual gross revenue above $26,625,000 (the figure since 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households per year, or earning 50% or more of annual revenue from selling or sharing personal information. Doing business in California does not require an office there; an online store or publisher with Californian customers qualifies if it crosses a threshold. Service providers and contractors that process data for a business have their own, lighter obligations.

What does it require for cookies and trackers?

The key concepts are sale and sharing. Sharing means disclosing personal information for cross-context behavioral advertising, whether or not money changes hands. A Meta Pixel, a Google Ads remarketing tag or an ad network cookie that builds profiles across sites is sharing. Cookie identifiers, IP addresses and device identifiers are personal information under the Act.

Rather than prior consent, the law gives consumers rights that the website must support:

• Right to opt out of sale or sharing (section 1798.120). The business must stop selling or sharing within 15 business days and must not ask the consumer to create an account to opt out.
• The link (section 1798.135). A clear and conspicuous "Do Not Sell or Share My Personal Information" link on the homepage, and a "Limit the Use of My Sensitive Personal Information" link where relevant, or a single "Your Privacy Choices" link that leads to both. A business that honors opt-out preference signals in a frictionless way may rely on them instead of posting the links.
• Opt-out preference signals (regulations, section 7025). A browser signal such as Global Privacy Control must be treated as a valid request to opt out of sale and sharing, for the browser and, where the consumer is known, for the account. Since 1 January 2026 the business must display whether it has processed the signal.
• Minors. Selling or sharing the personal information of a consumer under 16 requires opt-in consent.
• Symmetry and no dark patterns (regulations, section 7004). Opting out must not take more steps than opting in, choices must be presented in a balanced way, and consent obtained through dark patterns is not consent.
• Notice at collection and privacy policy, listing the categories collected, the purposes, and whether they are sold or shared.

Analytics on its own is not sharing if the provider acts as a service provider under a compliant contract and does not use the data for its own purposes. Advertising use of the same data is.

What must a compliant banner or notice do?

For a California visitor the right pattern is an opt-out notice, not an EU-style opt-in banner: a short notice that the site shares data for advertising, a "Do not sell or share my personal information" link that opens the preference center, and tags that stop sharing once the visitor opts out or sends a GPC signal. If you serve both EU and US visitors, geo-targeting lets you show each audience the right experience. Showing an EU consent banner to Californians is allowed, but it does not replace the opt-out link, the GPC handling or the privacy policy wording.

Enforcement and fines

The Attorney General and the CPPA can both enforce, and the 30-day right to cure disappeared on 1 January 2023. Penalties are $2,663 per violation and $7,988 per intentional violation or violation involving a consumer the business knows is under 16, as adjusted on 1 January 2025; each consumer affected can count as a separate violation.

Cookies and opt-outs have been the main theme of enforcement so far:

In September 2025 the CPPA and the attorneys general of California, Colorado and Connecticut announced a joint sweep of businesses that fail to honor opt-out preference signals. Other states follow the same logic; see US state privacy laws.

How Cookiequiet handles the CCPA

For visitors in California (and the other US states with a privacy law), Cookiequiet can show an opt-out notice instead of the consent banner, with a "Do not sell or share my personal information" link that opens the preference center, and it honors Global Privacy Control as an opt-out automatically. Marketing tags held by the category system stop when the visitor opts out, and Google Consent Mode v2 signals are updated so Google Ads stops personalization. Each opt-out is written to the consent log with its date and the banner version, which is the record you need if the Attorney General asks how you processed a request. The privacy policy generator includes the CCPA/CPRA sections (categories, purposes, the rights and how to exercise them) as a template; it is not legal advice, and the thresholds above decide whether the law applies to you at all. See also the Do Not Sell link explained.