CCPA REQUIREMENTS FOR WEBSITES
Under CCPA, tracking runs until a visitor says stop.
California’s privacy law lets websites collect data by default, but visitors must be able to opt out of the sale or sharing of their personal information, including through a signal from their browser. ConsentBit adds the opt-out, honors Global Privacy Control automatically, and records every choice.
Google-certified CMP · IAB Europe registered CMP (ID 502) · Works on Webflow, Framer, WordPress and any website builder
Footer of your site
Do Not Sell or Share My Personal InformationGlobal Privacy Control detected
Opt-out applied. Sale and sharing scripts blocked.
One clear link: Do Not Sell or Share My Personal Information.
Global Privacy Control is honored automatically, with no click needed.
California’s privacy law, with penalties per violation.
The California Consumer Privacy Act (CCPA) protects the personal information of California residents. The California Privacy Rights Act (CPRA) expanded it, with most changes in effect from 2023. It applies to for-profit businesses anywhere that do business in California and meet a size or data threshold.
Maximum penalty
$7,988
per intentional violation, or per violation involving consumers under 16. Other violations: up to $2,663 each.
In effect since
1 January 2020 (expanded by CPRA in 2023)
Default model
Opt-out. Tracking can run, but visitors must be able to stop the sale or sharing of their data.
Five things CCPA expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
What CCPA requires
Tell visitors that you collect their data, at or before the point of collection
How ConsentBit handles it
The banner tells visitors that data is collected by default, as soon as they land.
What CCPA requires
Offer a “Do Not Sell or Share My Personal Information” link
How ConsentBit handles it
The banner shows the link. One click opens the opt-out choice.
What CCPA requires
Treat Global Privacy Control as an opt-out
How ConsentBit handles it
ConsentBit detects the signal and opts the visitor out automatically. Honoring GPC is on by default.
What CCPA requires
Stop selling or sharing within 15 business days of an opt-out
How ConsentBit handles it
Scripts used for selling or sharing are blocked the moment a visitor opts out.
What CCPA requires
Keep records of consumer requests for 24 months
How ConsentBit handles it
Every opt-out is logged with the date and time, and paid plans keep logs with no retention limit.
What a visitor sees, step by step
Nothing is blocked by default. The visitor stays in control of whether their data is sold or shared.
They land on your site
A notice explains that data is collected. Your scripts run as normal.
They click the opt-out link
“Do Not Sell or Share My Personal Information” opens a single checkbox.
They opt out
Analytics, Marketing and Preferences scripts are blocked straight away. Necessary cookies keep running.
Or their browser does it for them
If the browser sends Global Privacy Control, the opt-out applies automatically, with no click.
“Selling” data covers more than you might think.
Under CCPA, “selling” means giving personal information to another business for money or anything else of value. “Sharing” means passing it on for cross-context behavioral advertising, such as ad pixels that track visitors across websites, even when no money changes hands. That’s why ad trackers on your site fall under the opt-out.
Your privacy choices
We may sell or share your personal information, for example through advertising cookies. You can opt out at any time.
Runs until they opt out
For US visitors, ConsentBit uses an opt-out model. Here’s what runs by default, and what changes when a visitor opts out or their browser sends Global Privacy Control.
Stricter than the minimum
CCPA only requires you to stop selling and sharing. ConsentBit also blocks Analytics and Preferences scripts when a visitor opts out.
Rules change by state
ConsentBit detects which US state a visitor is in and applies that state’s rules. In Utah, for example, only Marketing scripts are blocked after an opt-out.
Using Google tags? When a US visitor opts out, their Google Consent Mode signals switch to denied as well. See how Consent Mode V2 works →
Add a CCPA opt-out to your site, free.
A record of every opt-out, ready if you’re asked
Every choice is recorded with when it was made and whether the visitor opted out. CCPA requires businesses to keep records of consumer requests for at least 24 months. You can export the log as CSV or JSON whenever you need it.
Consent log
The visitor opted out, so sale and sharing scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
FAQ
CCPA questions, answered
Short answers to what website owners ask most.
Does CCPA apply to my business?
CCPA applies to for-profit businesses that do business in California, collect personal information from California residents, and meet at least one of these: annual gross revenue above $26,625,000; buying, selling or sharing the personal information of 100,000 or more California consumers or households; or earning at least half of annual revenue from selling or sharing personal information. The business doesn't have to be based in California.
Do I need a cookie banner for CCPA?
CCPA doesn't require opt-in cookie consent the way GDPR does. It does require a notice at or before the point of collection and, if you sell or share personal information, including through advertising trackers, a "Do Not Sell or Share My Personal Information" link. A banner is a common way to do both.
Is Global Privacy Control mandatory under CCPA?
Yes. California's CCPA regulations require businesses to treat a Global Privacy Control signal as a valid request to opt out of sale and sharing. Since 1 January 2026, businesses must also show whether that opt-out was processed. And under California's Opt Me Out Act, browsers must offer a built-in opt-out setting from 1 January 2027.
Who enforces CCPA, and what are recent fines?
The California Privacy Protection Agency and the California Attorney General both enforce it. In 2025, the agency fined Tractor Supply $1.35 million, partly for not honoring GPC signals until July 2024, and Honda $632,500, partly for a cookie tool that made opting out harder than accepting. The Attorney General settled with Healthline for $1.55 million over opt-outs, including GPC signals, that weren't honored. Consumers can only sue directly over certain data breaches.
What's the difference between CCPA and CPRA?
The CPRA is a 2020 ballot measure that amended and expanded the CCPA, with most changes in effect from 1 January 2023. It created the California Privacy Protection Agency, added the right to opt out of "sharing" for cross-context behavioral advertising, and added rights to correct data and limit the use of sensitive personal information. Today, "CCPA" usually means the law as amended by the CPRA.
What's the difference between CCPA and GDPR?
CCPA is opt-out: data collection can start by default as long as visitors are told about it, but they must be able to stop the sale or sharing of their personal information. GDPR is opt-in: non-essential cookies stay off until a visitor agrees. With geo-targeting, ConsentBit can show a CCPA banner to US visitors and a GDPR banner to everyone else.
(Link: "See what GDPR requires" → https://www.consentbit.com/gdpr)
Do other US states have laws like CCPA?
Yes. As of September 2026, around 20 US states have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah and Texas. Most follow an opt-out model like California's, and a growing number require websites to honor Global Privacy Control. ConsentBit has state-specific rules for California, Virginia, Colorado, Connecticut and Utah, and applies the California rules to visitors from other states.
Is there a free trial?
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes.
(Link: "See pricing")
Related reading
Give every visitor an easy way to say stop
Add a clear opt-out, honor Global Privacy Control automatically, and keep a record of every choice.