California Consumer Privacy Act (CCPA)
CCPA compliance solution for websites and apps: Do Not Sell or Share opt-out, Your Privacy Choices link, Global Privacy Control and IAB GPP. Set up in minutes.
CCPA Compliance – California Consumer Privacy Act Guide
UniConsent helps businesses achieve full CCPA compliance by offering tools that support consumer data rights and consent management. The California Consumer Privacy Act (CCPA) governs how websites and companies handle the personal information of California residents.
What Is the CCPA?
The California Consumer Privacy Act (CCPA) is a comprehensive data privacy law that took effect on January 1, 2020. It enhances the rights of California residents and regulates how businesses:
- Collect personal data
- Sell or share consumer information
- Respond to consumer data requests
Along with other privacy laws such as the GDPR, CCPA defines how businesses should handle website tracking, cookies, and user data in a privacy-compliant way. Learn more about how UniConsent supports CCPA compliance.
Does the CCPA Apply to My Business?
The CCPA regulation applies to businesses that meet at least one of the following thresholds:
- Generate over $26,625,000 in annual gross revenue (adjusted from $25 million on January 1, 2025)
- Collect personal data from 50,000 or more California residents, households, or devices annually
- Derive 50% or more of annual revenue from the sale of personal information
If your website or application falls under these criteria, you are legally required to comply with the California privacy law.
Do Not Sell or Share My Personal Information: CCPA Rule
Under the CCPA, as amended by the CPRA, businesses that sell personal information or share it for cross-context behavioral advertising must give consumers a clear way to opt out.
To meet this requirement:
- Provide a "Do Not Sell or Share My Personal Information" link, or the "Your Privacy Choices" link with its opt-out icon
- Place the link where consumers can easily find it, such as your website footer
- Allow users to opt out without creating an account
- Treat a Global Privacy Control (GPC) signal as a valid opt-out request
- Offer "Limit the Use of My Sensitive Personal Information" when you use sensitive personal information for other purposes
- Wait at least 12 months before asking a consumer who opted out to opt back in
UniConsent shows the CCPA notice with a one-click opt-out on the first layer, keeps the detailed settings behind Manage Options, and provides the opt-out link for your footer.
CCPA Cookie Consent Manager by UniConsent
Cookies and tracking technologies may be considered personal information under CCPA. These technologies collect data such as:
- IP addresses
- Device identifiers
- Location information
- Browsing behavior
To comply with CCPA, your business should:
- Provide opt-in and opt-out mechanisms for cookies
- Allow users to control cookie categories
- Inform users of the types of cookies being used
Use the UniConsent Cookie Consent Manager to ensure your website meets California data protection standards.
Consumer Rights Under the CCPA
The CCPA grants California residents several key consumer data rights, including:
- Right to Know: Consumers can request disclosure of personal data collected, used, shared, or sold in the past 12 months.
- Right to Delete: Consumers can request the deletion of personal data collected by the business.
- Right to Opt Out: Consumers can opt out of the sale of personal data to third parties.
- Right to Non-Discrimination: Businesses must not discriminate against users who exercise their privacy rights.
UniConsent enables these user rights management features through a compliant interface that simplifies privacy request handling. Learn more on the CCPA Consent Management page.
What Is Considered Personal Information Under the CCPA?
Personal information under CCPA includes, but is not limited to:
- Identifiers: cookies, device IDs, IP addresses, account usernames, email addresses
- Biometric information: face scans, fingerprints, voice recordings, DNA
- Geolocation data: GPS and location history
- Internet activity: browsing history, interaction with websites, ads, and apps
- Profile information: inferences drawn from personal data (e.g., preferences, behaviors)
If your website collects any of this information through cookies or other tracking mechanisms, a CCPA-compliant cookie banner is essential. Visit UniConsent’s CCPA Solutions for more information.
To understand what counts as personal data, see what PII (personally identifiable information) is.
How UniConsent Helps You Stay CCPA Compliant
UniConsent covers the CCPA and CPRA requirements in one platform:
- "Do Not Sell or Share" and "Your Privacy Choices" opt-out links, translated into every banner language
- "Limit the Use of My Sensitive Personal Information" for the sensitive data purposes you define
- Global Privacy Control (GPC) honored as an opt-out of sale, sharing and targeted advertising
- IAB Global Privacy Platform (GPP) and US Privacy signals for your advertising partners
- US State Privacy for 19 more states, from Virginia and Colorado to Texas and New Jersey
- Google Consent Mode v2 updated from each user's choice
- Tools to manage user access and deletion requests
- Mobile SDKs for iOS, Android, Flutter and React Native with the same opt-out and GPP signals
Explore UniConsent's CCPA compliance tools to protect your business and respect consumer privacy.
Additional CCPA Resources
- Official CCPA Text from the California Attorney General
- CCPA vs GDPR: Key Differences
- UniConsent Guide: CPRA
- UniConsent Guide: Global Privacy Control
- CCPA Consent Solutions by UniConsent
- IAPP CCPA Overview
Frequently Asked Questions
How do I make my website CCPA compliant?
Give a privacy notice at collection, add a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link, honor opt-outs including Global Privacy Control signals, pass the opt-out to your ad partners, and answer consumer requests within 45 days. UniConsent covers the banner, the footer link, GPC and the IAB GPP signal.
Who does the CCPA apply to?
For-profit businesses that do business in California and have annual gross revenue over $26,625,000, buy, sell or share the personal information of 100,000 or more California consumers or households, or earn 50% or more of their revenue from selling or sharing personal information.
Does the CCPA require cookie consent?
The CCPA is an opt-out law: adults do not have to opt in before cookies load, but they must be able to opt out of the sale or sharing of their data, including through advertising cookies. Opt-in consent is required to sell or share the data of consumers under 16.
Do I have to honor Global Privacy Control under the CCPA?
Yes. The CCPA regulations require businesses to treat a Global Privacy Control signal as a valid request to opt out of the sale and sharing of personal information for that browser.
What are the CCPA penalties?
Since January 1, 2025, administrative fines and civil penalties are up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16. Each affected consumer can count as a separate violation.
CCPA Compliance by UniConsent
- Opt-out banner and Do Not Sell or Share link
- Your Privacy Choices link with the opt-out icon
- Limit the Use of My Sensitive Personal Information
- Global Privacy Control (GPC) support
- IAB GPP with MSPA and US state sections for your ad partners
- US State Privacy for 19 more states
- Google Consent Mode v2 support
- One-tag Implementation
- Google Tag Manager support
- Multiple languages support
- JavaScript tags blocking and cookies blocking
- Mobile SDK for iOS, Android, Flutter, React Native
- Easy self-serve solution
Comply With Global Privacy Regulations
Get started to make your website and application compliant for EU GDPR, US CPRA, CA PIPEDA etc
Sign upStay ahead on privacy and consent
Privacy laws, consent and compliance updates, a few emails a month.