CCPA / CPRA Cookie Consent: What California Law Requires

The California Consumer Privacy Act (CCPA), as amended by the CPRA, works differently from the GDPR. It follows an opt-out model: a site may collect and "sell" (a broad legal term that includes sharing with third parties like ad networks for value) visitor data by default, but must give an explicit, easy way to opt out.

Who it applies to

CCPA/CPRA applies to businesses that process California residents' data and meet at least one threshold: annual revenue over $25 million, processing data for 100,000+ California consumers or households per year, or deriving 50%+ of revenue from selling or sharing personal data.

Key website requirements

• A "Do Not Sell or Share My Personal Information" link (or a combined "Your Privacy Choices" link) visible on every page;
• Automatic recognition of the Global Privacy Control (GPC) signal — if a visitor's browser sends it, opt-out must be honored without further action;
• Separate handling of "sensitive" personal information, with the ability to limit its use;
• A clear privacy policy listing categories of data collected and purposes;
• A mechanism for consumers to exercise their rights: know, delete, correct, and obtain a copy of their data.

How it differs from a GDPR banner

Under GDPR, a banner must block everything by default until explicit opt-in consent. Under CCPA/CPRA, a banner with a clear opt-out link plus GPC compliance is usually enough — no mandatory blocking screen required. Sites with international audiences often show a different banner variant based on visitor geolocation.

Fines

The California Privacy Protection Agency (CPPA) and the state Attorney General can seek up to $2,500 per violation, and up to $7,500 for intentional violations or those involving minors' data. With enough affected users, these amounts add up quickly.

Getting compliant quickly

Cookiestack supports both the opt-in logic required by GDPR/152-FZ and the opt-out flow with GPC recognition required by CCPA/CPRA — in one widget, with the banner adapting to visitor location automatically.

Start for free →

This article is for informational purposes only and is not legal advice. Consult a qualified data protection lawyer for your specific situation.