> What the CCPA, as amended by the CPRA, requires for cookies: Do Not Sell or Share link, Global Privacy Control, thresholds, fines and real enforcement cases. > > Canonical: https://www.flowconsent.com/en/laws/ccpa-cpra Cookie law # CCPA and CPRA cookies: what California law requires from your website What the CCPA, as amended by the CPRA, requires for cookies: Do Not Sell or Share link, Global Privacy Control, thresholds, fines and real enforcement cases. Updated October 9, 2026 · 10 min read [Scan my site for free](https://www.flowconsent.com/en/scan) · [Try FlowConsent for free](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=laws) ## Fact sheet - Full name California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (Proposition 24) - Jurisdiction California, United States - In force since 1 January 2020 (CPRA amendments from 1 January 2023) - Authority California Privacy Protection Agency (CalPrivacy) and the California Attorney General - Maximum fine $2,663 per violation, $7,988 per intentional violation or violation involving minors (2025 adjusted amounts) - Consent model Opt-out ## Key points - The CCPA is an opt-out law: you may use advertising cookies by default, but Californians must be able to stop the sale or sharing of their personal information. - It applies to for-profit businesses doing business in California that pass a revenue, volume or data-selling threshold. - Sites that sell or share data must offer a Do Not Sell or Share My Personal Information link (or the Your Privacy Choices alternative) and honor Global Privacy Control. - A cookie banner on its own is not an acceptable opt-out method, and choices must be symmetrical, with no dark patterns. - Selling or sharing data of consumers under 16 requires opt-in consent, from a parent for children under 13. - CalPrivacy and the Attorney General enforce the law, with fines per violation and public cases against Sephora, Honda and Tractor Supply. Contents > **In short:** The CCPA, as amended by the CPRA, does not require prior consent for cookies, but it requires you to let Californians opt out of the sale or sharing of their personal information, through a clear link and through browser signals such as Global Privacy Control. It applies to for-profit businesses that do business in California and cross a revenue or data volume threshold, wherever they are based. Regulators are actively fining companies whose opt-out tools are broken, asymmetrical or blind to GPC. ## CCPA / CPRA: what is it? The California Consumer Privacy Act of 2018 is the main privacy law in California. It became operative on **1 January 2020**. In November 2020, California voters approved **Proposition 24**, the California Privacy Rights Act (CPRA), which amended the CCPA. According to the California Attorney General, these amendments took effect on **1 January 2023**. There is one law today: the CCPA as amended by the CPRA. The statute sits in the California Civil Code (section 1798.100 and following). It is completed by detailed regulations in Title 11, Division 6 of the California Code of Regulations, adopted by the California Privacy Protection Agency, which now presents itself as **CalPrivacy**. The latest package of updates, approved on 22 September 2025, took effect on **1 January 2026**. The law protects "consumers", meaning California residents. It gives them the right to know what personal information is collected, to delete it, to correct it, to opt out of its sale or sharing, and to limit the use of sensitive personal information. For a website, the right that matters most is the **right to opt out of sale and sharing**, because that is exactly what advertising cookies and pixels tend to trigger. The key word is "share". Under the CPRA, sharing means disclosing personal information to a third party **for cross-context behavioral advertising**, whether or not money changes hands. Cross-context behavioral advertising is advertising targeted on the basis of a person's activity across other businesses, websites, apps or services. A retargeting pixel is the textbook example. ## Who does CCPA / CPRA apply to? The CCPA applies to a for-profit entity that collects consumers' personal information, determines why and how it is processed, does business in California, and meets **at least one** of these thresholds: - **Annual gross revenue above $26,625,000** in the preceding calendar year. The statute says $25,000,000, but CalPrivacy adjusts the figure for inflation every odd-numbered year, and the adjusted amount applies since 1 January 2025. - Buying, selling or sharing the personal information of **100,000 or more** California consumers or households each year. - Deriving **50% or more** of annual revenue from selling or sharing consumers' personal information. There is no requirement to be established in California. An online store in Texas, a SaaS company in New York or a publisher in Europe can be covered if it does business in California and crosses a threshold. The third threshold is easy to miss: a small site that earns most of its money from advertising based on visitor data can qualify even with modest revenue. The law also reaches the companies around you. **Third parties** that control the collection of personal information on your website, such as some ad networks, must give their own notice at collection, and service providers and contractors must sign contracts with specific privacy terms. If you are under the thresholds, the CCPA does not apply to you directly, but your partners may still ask you to pass on opt-out signals. ## What CCPA / CPRA requires for cookies and consent ### An opt-out model, not opt-in Unlike the GDPR and ePrivacy rules in Europe, the CCPA does not ask for consent before cookies are set. Cookies can load by default. What the law requires is that consumers can say no to the sale or sharing of their data at any time, and that you respect that choice. That is why the consumer model is "Opt-out". There is one important exception. If you have actual knowledge that a consumer is **under 16**, you cannot sell or share their personal information unless they have affirmatively authorized it (opt-in). For children **under 13**, the authorization must come from a parent or guardian. Willfully disregarding a consumer's age counts as actual knowledge. ### Notice at collection You must tell consumers, **at or before the point of collection**, which categories of personal information you collect, why, whether you sell or share them, and how long you keep each category (or the criteria used to decide). On a website, this usually means a conspicuous link to the notice on the homepage and on every page where data is collected. Your privacy policy must also describe consumers' rights. ### The opt-out link A business that sells or shares personal information must post a conspicuous **"Do Not Sell or Share My Personal Information"** link in the header or footer of its homepage. Clicking it must either opt the consumer out immediately or lead to a page where they can make that choice. Instead of that link, you can use the **Alternative Opt-out Link** titled "Your Privacy Choices" or "Your California Privacy Choices", with the official opt-out icon, which also covers the right to limit sensitive data. ### Opt-out preference signals and Global Privacy Control The regulations require any business that sells or shares personal information to treat a qualifying **opt-out preference signal**, such as Global Privacy Control (GPC), as a valid request to opt out for that browser or device and any profile linked to it. You cannot demand extra information to process it. Since the January 2026 updates, the regulations say you **must display** whether you processed the signal, for example with a message such as "Opt-Out Preference Signal Honored" or a toggle showing that the consumer is opted out. The pressure on this point is increasing. A new section 1798.136 of the Civil Code, operative on **1 January 2027**, will require businesses that develop or maintain a web browser to include a setting that sends an opt-out preference signal. ### Why a cookie banner is not enough This is the trap for sites that reuse a European banner. The regulations state that a cookie banner or cookie controls are **not by themselves** an acceptable method to opt out of sale or sharing, because cookies concern collection, not sale or sharing. A business that collects data online must accept opt-out requests through an opt-out preference signal **and** at least one other method, such as an interactive form behind the Do Not Sell or Share link. ### Timing, proof and re-asking Once you receive an opt-out, you must stop selling and sharing as soon as feasibly possible and **within 15 business days**, and notify the third parties that received the data in the meantime. You cannot require an account or identity verification for an opt-out. You must wait **at least 12 months** before asking someone who opted out to opt back in. Keep records of the requests you receive and how you handled them, so you can show a regulator that your mechanism worked. ## A CCPA / CPRA-compliant cookie banner If you show a banner to Californian visitors, it must follow the CCPA rules on choice architecture, which the regulations call **symmetry in choice**. The path to the more privacy-protective option must not be longer, harder or slower than the path to the less protective one. A compliant setup usually includes: - A short notice explaining what is collected and whether it is sold or shared, with a link to the full notice at collection. - A **"Do Not Sell or Share My Personal Information"** or **"Your Privacy Choices"** link that stays reachable in the footer, not just in the banner. - Automatic detection of **Global Privacy Control**, with a visible confirmation that the signal was honored. - If you ask for consent (for example for minors' data or sensitive data), buttons such as "Accept All" and "Decline All" with equal weight. The regulations give concrete examples of what is **not** symmetrical: - A banner that offers only "Accept All" and "More Information", or "Accept All" and "Preferences". - A "Yes" button that is larger or more eye-catching than the "No" button. - A choice between "Yes" and "Ask me later", with no way to decline. - Double negatives, such as a Yes/No choice next to "Do Not Sell or Share My Personal Information", or "on/off" toggles without clear labels. The statute defines a dark pattern as an interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making or choice. CalPrivacy's September 2024 enforcement advisory insists that what counts is the effect of the design, not the intent behind it. For practical design advice, see our [cookie banner guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) and our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited): the European rules are stricter, but the principles of equal choices carry over. ## Penalties and enforcement Two public authorities enforce the CCPA. **CalPrivacy** (the California Privacy Protection Agency) brings administrative actions, and the **California Attorney General** brings civil actions in court. Consumers can only sue directly after certain data breaches. The statute sets fines of up to $2,500 per violation and $7,500 per intentional violation or violation involving consumers known to be under 16. With the inflation adjustment in force since 1 January 2025, the amounts are **$2,663** and **$7,988** per violation. The amounts apply per violation, so a flaw that affects many visitors can add up quickly, as the cases below show. Three published cases show what regulators look at on websites: - **Sephora (Attorney General, August 2022): $1.2 million.** The Attorney General found that Sephora let third-party trackers on its website and app monitor shoppers, did not disclose that this was a sale of personal information, and failed to process opt-out requests sent through Global Privacy Control. ([press release](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement)) - **Honda (CalPrivacy, March 2025): $632,500.** Among the violations: an online privacy management tool that did not offer choices in a symmetrical way, excessive information required to exercise privacy rights, and sharing data with ad tech companies without contracts containing the required terms. ([announcement](https://cppa.ca.gov/announcements/2025/20250312.html)) - **Tractor Supply (CalPrivacy, September 2025): $1,350,000.** CalPrivacy found that the retailer failed to provide an effective way to opt out of selling and sharing, including through opt-out preference signals such as Global Privacy Control, and that its privacy notices were inadequate. ([announcement](https://cppa.ca.gov/announcements/2025/20250930.html)) In May 2025, CalPrivacy also fined the clothing retailer Todd Snyder $345,178, notably because its privacy portal failed to process opt-out requests for 40 days and because it required identity verification before an opt-out. A misconfigured tool is not an excuse. ## Compliance checklist 1. **Check the thresholds**: revenue above $26,625,000, 100,000 or more California consumers or households, or 50% of revenue from selling or sharing data. 2. **Map your trackers** with a cookie scan and identify which tags sell or share data for cross-context behavioral advertising. 3. **Review contracts** with analytics and ad tech vendors so that service providers are bound by the required terms. 4. **Publish a notice at collection** and update your privacy policy, including retention periods and consumer rights. 5. **Add the "Do Not Sell or Share My Personal Information" link** or the "Your Privacy Choices" link with the icon, in the header or footer. 6. **Detect and honor Global Privacy Control** automatically, and display that the signal was honored. 7. **Make choices symmetrical**: no "Accept All" without an equivalent decline option, no visual bias, no confusing toggles. 8. **Process opt-outs within 15 business days**, without account creation or ID checks, and pass them on to third parties. 9. **Handle minors**: get opt-in consent before selling or sharing data of consumers you know are under 16. 10. **Keep records** of opt-out requests and test your mechanism regularly so it never silently breaks. ## How FlowConsent helps you comply with CCPA / CPRA FlowConsent gives you the technical side of compliance without a long project. Start with the [free scanner](https://www.flowconsent.com/en/scan) to see which cookies and trackers your site loads, including the advertising tags most likely to count as selling or sharing. The automatic scan keeps that inventory up to date over time. The banner is set up in about ten minutes, blocks scripts until the visitor's choice allows them, and integrates Google Consent Mode v2. Each choice is logged, and you can export proof of consent when a regulator or partner asks for it. Our documentation explains how to [classify services and their legal basis](https://www.flowconsent.com/en/doc/services-and-legal-basis) for each tool on your site. FlowConsent is free up to 25,000 sessions per month and hosted in Europe. [Create your free account](https://app.flowconsent.com/auth/register) to get started. ## Further reading If your site also serves European visitors, the key question is how to reconcile opt-out in California with opt-in in Europe: our comparison of [CCPA vs GDPR for cookies](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) covers it in detail. The articles below also explain how to audit your trackers, design a balanced banner and set up Google Consent Mode v2. Further reading ## Go further on CCPA / CPRA. Practical guides from our blog to put these rules into practice on your site. [Blog](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) ### [CCPA vs GDPR: the real differences for cookies](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences) [Read the article ](https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences)· [Blog](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) ### [GDPR-compliant cookie banner: the complete guide](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) [Read the article ](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide)· [Blog](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) ### [Cookie dark patterns: what the CNIL prohibits in consent banners](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) [Read the article ](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited)· [Blog](https://www.flowconsent.com/en/blog/do-i-need-cookie-banner-website) ### [Do I need a cookie banner on my website?](https://www.flowconsent.com/en/blog/do-i-need-cookie-banner-website) [Read the article ](https://www.flowconsent.com/en/blog/do-i-need-cookie-banner-website)· [Blog](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) ### [Website cookie audit: the complete guide to scanning your trackers](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) [Read the article ](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide)· [Blog](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) ### [Google Consent Mode v2: the complete guide to understanding and implementing it](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) [Read the article](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) Questions ## CCPA / CPRA and cookies: your questions Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does the CCPA require a cookie consent banner? Not in the GDPR sense. The CCPA is an opt-out law, so you do not need prior consent before setting cookies for adults. You do need a notice at collection, and if your cookies lead to selling or sharing personal information, a Do Not Sell or Share link and support for opt-out preference signals. The regulations add that a cookie banner alone is not an acceptable way to opt out, because cookies concern collection rather than sale or sharing. ### Do I have to honor Global Privacy Control? Yes, if you sell or share personal information. The CCPA regulations require businesses to treat a qualifying opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sale and sharing for that browser or device. You cannot ask for extra information to process it, and you must display whether you honored it. The Attorney General's Sephora settlement and CalPrivacy's Tractor Supply decision both penalized companies that ignored GPC. ### Does the CCPA apply to my business if I am not based in California? It can. The law covers for-profit businesses that do business in California and meet at least one threshold: more than $26,625,000 in annual gross revenue (the 2025 adjusted figure), buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning 50% or more of annual revenue from selling or sharing it. Physical presence in California is not one of the criteria. ### Is using Google Analytics or a Meta Pixel a sale or sharing of data? It depends on how the data flows. Sharing means disclosing personal information to a third party for cross-context behavioral advertising, even without payment. Advertising pixels that track visitors across sites usually fall into that category. Analytics run by a service provider under a CCPA-compliant contract is not a sale. The Attorney General found that Sephora sold data by letting third-party trackers collect it on its website. Review each tag and its contract. ### How fast must I process an opt-out request? The regulations require you to stop selling and sharing the consumer's personal information as soon as feasibly possible, and no later than 15 business days after you receive the request. You must also notify the third parties that received the data in the meantime and direct them to comply. Opt-out requests cannot require an account or identity verification, and you must wait at least 12 months before asking the person to opt back in. ### What is the difference between the CCPA and the CPRA? The CPRA is not a separate law. Approved by California voters as Proposition 24 in November 2020, it amended the CCPA from 1 January 2023. It added the right to correct, the right to limit the use of sensitive personal information, the concept of sharing for cross-context behavioral advertising and the California Privacy Protection Agency, now branded CalPrivacy. In practice, complying with the CCPA today means complying with the amended text. ## Official sources The texts and guidance this page is based on. - [California Attorney General: California Consumer Privacy Act (CCPA) ](https://oag.ca.gov/privacy/ccpa)oag.ca.gov - [CalPrivacy: CCPA statute, effective 1 January 2026 ](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf)cppa.ca.gov - [CalPrivacy: approved text of the CCPA regulations (updates effective 1 January 2026) ](https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf)cppa.ca.gov - [CalPrivacy: CCPA updates regulations, approval and effective date ](https://cppa.ca.gov/regulations/ccpa_updates.html)cppa.ca.gov - [CalPrivacy: updated monetary thresholds in the CCPA ](https://cppa.ca.gov/regulations/cpi_adjustment.html)cppa.ca.gov - [CalPrivacy: enforcement advisory on dark patterns (September 2024) ](https://cppa.ca.gov/announcements/2024/20240904.html)cppa.ca.gov - [CalPrivacy: Honda settles with CPPA over privacy violations (March 2025) ](https://cppa.ca.gov/announcements/2025/20250312.html)cppa.ca.gov - [CalPrivacy: Todd Snyder ordered to pay a fine (May 2025) ](https://cppa.ca.gov/announcements/2025/20250506.html)cppa.ca.gov - [CalPrivacy: Tractor Supply to pay $1.35M over CCPA violations (September 2025) ](https://cppa.ca.gov/announcements/2025/20250930.html)cppa.ca.gov - [California Attorney General: settlement with Sephora (August 2022) ](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement)oag.ca.gov Other laws ## Other cookie and privacy laws. [GDPR · Opt-in](https://www.flowconsent.com/en/laws/gdpr) ### [GDPR and cookies: what the law requires from your website](https://www.flowconsent.com/en/laws/gdpr) [Read the guide ](https://www.flowconsent.com/en/laws/gdpr)· [ePrivacy Directive · Opt-in](https://www.flowconsent.com/en/laws/eprivacy-directive) ### [ePrivacy Directive and cookies: the rule behind every consent banner](https://www.flowconsent.com/en/laws/eprivacy-directive) [Read the guide ](https://www.flowconsent.com/en/laws/eprivacy-directive)· [UK GDPR / PECR · Opt-in](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) ### [UK GDPR, PECR and cookies: what UK law requires from your website](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) [Read the guide ](https://www.flowconsent.com/en/laws/uk-gdpr-pecr)· [TDDDG · Opt-in](https://www.flowconsent.com/en/laws/tdddg) ### [TDDDG and cookies: what Germany's section 25 requires from your website](https://www.flowconsent.com/en/laws/tdddg) [Read the guide ](https://www.flowconsent.com/en/laws/tdddg)· [nFADP · Opt-out](https://www.flowconsent.com/en/laws/nfadp-switzerland) ### [Swiss nFADP and cookies: what the revised Data Protection Act requires from your website](https://www.flowconsent.com/en/laws/nfadp-switzerland) [Read the guide ](https://www.flowconsent.com/en/laws/nfadp-switzerland)· [LGPD · Mixed](https://www.flowconsent.com/en/laws/lgpd-brazil) ### [LGPD and cookies: what Brazil's data protection law requires from your website](https://www.flowconsent.com/en/laws/lgpd-brazil) [Read the guide ](https://www.flowconsent.com/en/laws/lgpd-brazil)· [LOPDGDD · Opt-in](https://www.flowconsent.com/en/laws/lopdgdd-spain) ### [LOPDGDD and cookies: what Spanish law requires from your website](https://www.flowconsent.com/en/laws/lopdgdd-spain) [Read the guide](https://www.flowconsent.com/en/laws/lopdgdd-spain) [See all laws](https://www.flowconsent.com/en/laws) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)