CCPA cookie banner: requirements, GPC and how to comply

If you have already built a banner for European visitors with our GDPR cookie banner guide, the California rules will look familiar on the surface and very different underneath. This article covers what the California Consumer Privacy Act (as amended by the CPRA) actually asks of cookies, what a compliant CCPA cookie banner contains, and how to test it.

Does the CCPA require a cookie banner?

Not in so many words. The statute and its regulations never use the term "cookie banner". What they do impose are four obligations that land on cookies as soon as they collect personal information, which in California includes cookie IDs, IP addresses and device identifiers:

1. Notice at collection (section 7012 of the regulations): visitors must be told, at or before the point of collection, which categories of data you collect and why. On a website, that means a conspicuous link to this notice wherever data is collected.
2. The right to opt out of sale and sharing (Civil Code 1798.120): if your trackers sell or share data, visitors must be able to say no, through a "Do Not Sell or Share My Personal Information" link or the alternative "Your Privacy Choices" link.
3. Opt-out preference signals (section 7025): the Global Privacy Control signal sent by the browser must be treated as a valid opt-out.
4. Symmetry in choice (section 7004): the path to say no cannot be longer or harder than the path to say yes.

A banner is simply the most practical place to deliver all four. That is why most guides, and most regulators' examples, talk about a "CCPA cookie banner" even though the law itself does not.

Who has to comply

The CCPA applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue above $26,625,000 (the figure adjusted by the California Privacy Protection Agency from January 2025), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. A European company with a US audience can fall in scope through the second or third test. The full text and thresholds are summarized on our CCPA and CPRA law page.

When cookies count as "selling" or "sharing"

This is the question that decides whether you need an opt-out at all. Under the CPRA, "sharing" means disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands. "Selling" covers any disclosure for "valuable consideration", which is broader than a cash payment.

In practice:

• Advertising pixels (Meta Pixel, TikTok Pixel, Google Ads remarketing, LinkedIn Insight Tag) send browsing data to platforms that use it to target ads elsewhere. That is the textbook case of sharing.
• Analytics run by a provider bound by a service provider contract that limits its use of the data is usually not a sale. The same tool configured to share data with an ad network can become one.
• Strictly necessary cookies (session, cart, security, load balancing) are neither sold nor shared, and need no opt-out.

The California Attorney General made this concrete in August 2022 with a $1.2 million settlement against Sephora: the retailer let third-party trackers collect data on its site in exchange for analytics and advertising benefits, did not tell visitors it was selling data and did not honor Global Privacy Control.

Before deciding anything, you need an inventory of what actually fires on your pages. Check in 30 seconds which cookies your site sets with the free cookie scanner, then sort each one into necessary, analytics or advertising.

CCPA cookie requirements: what the banner must contain

Once you know some cookies sell or share data, the CCPA cookie banner (or the combination of banner and footer links) must cover the following points.

A notice at collection

A short sentence on the banner explaining that the site uses cookies for analytics and advertising, with a link to the notice at collection or the privacy policy section that lists categories, purposes, retention and whether data is sold or shared. Our article on cookie notices and cookie policies explains how the two documents fit together.

A clear way to opt out

The regulations offer two formats. Either a "Do Not Sell or Share My Personal Information" link (plus "Limit the Use of My Sensitive Personal Information" if you use sensitive data), or a single "Your Privacy Choices" link accompanied by the official toggle icon. The link must appear in the website footer or another conspicuous place on every page. On the banner itself, an "Opt out of sale/sharing" button or a toggle that takes effect immediately does the same job.

Choices of equal weight

Section 7004 gives explicit examples of what is not symmetrical: offering "Accept All" next to "More information", or "Yes" next to "Ask me later". If accepting takes one click, opting out must take one click. In March 2025 the California Privacy Protection Agency fined Honda $632,500, in part because its privacy management tool did not present choices in a symmetrical way. A concrete example of a banner built the other way round: FlowConsent shows Accept and Reject with the same size and color by default, and the styling options cannot break that balance.

No friction on the opt-out

An opt-out request does not need identity verification. Asking for an email address, an account or proof of residency to stop cookie sharing is a violation. Honda was also sanctioned for requiring too much information to process opt-outs, and in May 2025 the clothing retailer Todd Snyder agreed to pay $345,178 over opt-out failures and excessive verification requirements.

Respect for the Global Privacy Control signal

This is the requirement most often missed, so it gets its own section.

Global Privacy Control: the signal your banner must read

Global Privacy Control (GPC) is a browser setting that sends Sec-GPC: 1 with each request and exposes navigator.globalPrivacyControl to scripts. Firefox, Brave and DuckDuckGo support it, and extensions add it elsewhere. Under section 7025, a business must treat this signal as a valid request to opt out of sale and sharing for that browser, without asking the visitor to confirm. Regulations amended from January 2026 allow you to display that the signal has been honored, for example with a short "Opt-Out Preference Signal Honored" message.

Enforcement is active. Tractor Supply was fined $1.35 million by the CPPA in 2025, partly for not honoring GPC, and in July 2025 the Attorney General announced a $1.55 million settlement with Healthline over opt-out failures. In September 2025 California, Colorado and Connecticut announced a joint review of sites that ignore the signal. The pressure will grow: the Opt Me Out Act (AB 566), signed in October 2025, requires browsers to offer an opt-out preference setting from January 1, 2027, so the share of Californians sending GPC will rise.

Technically, honoring GPC means your banner script checks the signal before loading any advertising tag and, if it is present, keeps those tags blocked and records the opt-out.

CCPA cookie banner vs GDPR cookie banner

The two models start from opposite principles, as our comparison of CCPA and GDPR cookie rules details:

• GDPR and ePrivacy require prior consent: non-essential cookies stay blocked until the visitor clicks Accept. This is opt-in.
• CCPA allows cookies by default and requires an easy way to refuse their sale or sharing. This is opt-out.

Our guide to opt-in and opt-out consent explains the difference with examples. For a site with both European and Californian visitors, there are two valid strategies. The first is to apply the opt-in model everywhere: stricter than California requires, but one configuration and no geolocation errors. The second is to geotarget, with an opt-in banner for the EU and the UK and an opt-out banner for California. It maximizes data collection in the US but doubles the configuration to test. Other US states with comprehensive privacy laws (Colorado, Connecticut, Texas, Oregon and more) follow the opt-out logic too, with variations on sensitive data and universal opt-out signals.

How to set up a CCPA cookie banner, step by step

1. Inventory your trackers. Scan the site, list each cookie and script, its provider and purpose.
2. Classify them. Necessary, analytics under a service provider contract, advertising or cross-context profiling (sale or sharing).
3. Choose your model. Opt-in everywhere, or geotargeted opt-out for California.
4. Write the notice at collection and link it from the banner.
5. Add the opt-out. A "Do Not Sell or Share" or "Your Privacy Choices" link in the footer, and a reject or opt-out button on the banner with the same weight as accept.
6. Honor GPC. Block advertising tags when the signal is present and log the opt-out.
7. Test. Enable GPC in Firefox or Brave, load the site, and check in the network panel that no advertising request leaves. Then click the opt-out link with GPC off and verify the same result. Test again after each new tag.

For layout and wording ideas, our collection of cookie banner examples shows what balanced designs look like, and the article on whether you need a cookie banner helps if your site has no non-essential cookies at all.

Common mistakes on California sites

• An opt-out link that leads to a contact form or a generic privacy page.
• A banner with "Accept" only, and refusal hidden behind "Manage preferences".
• An opt-out that is recorded but does not stop the Meta Pixel or Google Ads tags.
• GPC ignored because the CMP was configured for GDPR only.
• Asking for an email address before processing a cookie opt-out.
• A cookie tool that silently stopped working after a site update, which is the kind of failure Todd Snyder was sanctioned for. Regular scans catch it.

How FlowConsent handles CCPA cookie banners

FlowConsent applies the opt-in model to every visitor, Californians included: advertising and analytics scripts stay blocked until the visitor accepts, Accept and Reject have equal weight, and a floating button lets anyone change their choice at any time. That covers the symmetry and no-friction requirements, and the data of a visitor who never accepts is never shared with ad networks. Each choice is kept as exportable proof of consent, and the automatic cookie scan helps detect new trackers after a site update. What the documentation does not describe today is a dedicated US opt-out mode with geolocation or automatic GPC detection: the "Your Privacy Choices" footer link and GPC handling remain your responsibility. If you need those built in for a US-first site, our Osano comparison is a fair starting point. Banner styling and the re-open button are covered in the banner customization guide.