CCPA and CPRA opt-out, done right
California uses an opt-out model. Trackers can run by default, but visitors must be told and given a clear way to stop the sale or sharing of their information, including through their browser.
- Who
- For-profit businesses meeting a CCPA threshold, such as $25M+ annual revenue (adjusted for inflation)
- Model
- Opt-out: allowed until the visitor objects, with stricter rules for sensitive data and minors
- Laws
- California Consumer Privacy Act as amended by CPRA, and CPPA regulations
What the law requires
Notice at collection
At or before the point information is collected, tell people what categories you collect, why, and whether it's sold or shared. A banner or footer link to that notice works for cookies.
Cal. Civ. Code §1798.100; CCPA Regs §7012
A Do Not Sell or Share link
If advertising cookies send data to third parties for cross-context behavioural advertising, that's selling or sharing. You must offer a clear Do Not Sell or Share My Personal Information link or an equivalent alternative opt-out.
Cal. Civ. Code §1798.120, §1798.135
Honour Global Privacy Control
Browsers and extensions can send an opt-out preference signal. Businesses must treat it as a valid request to opt out of sale and sharing for that browser.
CCPA Regs §7025
Limit use of sensitive information
Precise location, health and other sensitive data come with a right to limit its use. Don't load trackers that infer sensitive traits without offering that choice.
Cal. Civ. Code §1798.121
No dark patterns
Opting out must take no more steps than opting in, and the choices must be symmetrical in wording and design. Agreement obtained through dark patterns isn't consent.
CCPA Regs §7004
How Global Privacy Control works
Global Privacy Control is a single signal a browser sends with every request and exposes to scripts. Firefox, Brave and DuckDuckGo support it, and extensions add it to other browsers.
Plain Theory checks for the signal before any marketing tracker is released. When it's present, marketing stays off for that browser, even in an opt-out region where it would otherwise start on.
How Plain Theory handles it
Each requirement maps to something the product does by default. Nothing here needs a custom build.
| Requirement | In Plain Theory |
|---|---|
| Notice at collection | California-specific notice copy with a link to your privacy notice |
| Do Not Sell or Share | The reject action is labelled 'Do not sell or share my info' for California visitors |
| Global Privacy Control | navigator.globalPrivacyControl is read on every page and opts out of marketing |
| Opt-out model | Region rules start California visitors opted in and switch trackers off on request |
| Symmetrical choices | Equal-weight buttons and the same number of steps both ways |
| Record of requests | Every opt-out is logged as a receipt with time and notice version |
Common questions
Does an analytics cookie count as selling?
First-party analytics used only for your own measurement usually isn't a sale or share. Sending data to an ad platform for targeting across sites is. Put each tracker in the right category and the banner handles the rest.
Do other US states work the same way?
Colorado, Connecticut, Virginia, Texas and others have similar opt-out laws, and several also require honouring universal opt-out signals. The opt-out notice and GPC handling apply to them too; you can extend region rules to those states.
Do we need a banner at all in California?
Not necessarily a pop-up, but you need notice at collection and an easy opt-out. Many sites use a compact banner on first visit plus a persistent link. Plain Theory supports both.
Get CCPA/CPRA-ready this week
Free for your first site. Upgrade when you add more sites or teammates.
No card needed · GDPR, CCPA/CPRA and DPDPA from one script