Consentl

CCPA, CPRA and US state privacy laws for websites

What the CCPA, as amended by the CPRA, and other US state privacy laws require from websites with cookies: notice, an opt-out of sale and sharing, and GPC.

Opt-out instead of opt-in

US state privacy laws mostly work with opt-out: a website may use cookies for analytics and advertising, but it must tell visitors and let them opt out of the sale of their personal information, its sharing for cross-context behavioural advertising and, in most states, targeted advertising. Third-party advertising cookies and pixels are often a "sale" or "sharing" under these laws.

The California Consumer Privacy Act

The CCPA, as amended by the CPRA (in force since 2023), applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue above USD 25 million (adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning at least half of their revenue from selling or sharing personal information. It requires:

  • a notice at collection explaining what is collected and why;
  • a "Do Not Sell or Share My Personal Information" link, or an alternative opt-out link;
  • honouring Global Privacy Control (GPC) browser signals as a valid opt-out;
  • answering access, deletion and correction requests within 45 days.

The California Privacy Protection Agency and the Attorney General enforce it, with fines per violation that are adjusted for inflation and higher for intentional violations and those involving minors.

Other US states

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and a growing list of other states have comprehensive privacy laws with similar opt-out rights. Several of them, including Colorado, Connecticut, Texas and Oregon, require businesses to honour universal opt-out signals such as GPC. Thresholds, sensitive-data rules and deadlines differ by state.

How Consentl helps

  • A ready-made US rule: opt-out, with a notice and a link to the preferences where visitors can turn off the sale or sharing of their data.
  • Global Privacy Control honoured automatically: a GPC signal counts as an opt-out, and the record says so.
  • Tags held back after an opt-out, and Google Consent Mode updated.
  • A privacy request form with the 45-day CCPA deadline in your dashboard, and "Do Not Sell or Share" requests without identity verification, as the regulations require.

FAQ

Does the CCPA apply to a small website?

Only if the business meets one of the thresholds. Other state laws have their own thresholds, often based on the number of residents whose data you process.

The CCPA does not require an opt-in banner, but you must give notice and an easy opt-out. A banner with a link to the preferences is a common way to do both.

Start free Pricing

This page is general information, not legal advice. Laws and guidance change; check the current rules for your situation.

Features