CCPA compliance checklist for your website

CCPA compliance for a website comes down to five things a visitor can see: whether the law reaches you, a link in the footer, a browser signal your page honours, a notice where you collect data, and a privacy policy that says what you sell or share. Everything else lives inside the company.

This checklist is for the website owner, not the privacy team. It covers the California Consumer Privacy Act as amended by the CPRA, what California has enforced on each item, the other states that copied the model, and a short section on how it differs from the GDPR.

Who does CCPA apply to

The law covers a for-profit business that does business in California and meets one of three thresholds in section 1798.140(d). The CPPA’s copy of the statute gives the first as annual gross revenues in excess of twenty-five million dollars in the preceding year, as adjusted. The second is buying, selling or sharing the personal information of 100,000 or more consumers or households a year. The third is 50 percent or more of annual revenue from selling or sharing personal information. The CPPA’s FAQ puts the adjusted revenue figure at $26.625 million, effective 1 January 2025.

The statute defines sharing as passing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands. Cross-context behavioral advertising means targeting ads based on what a person did on other companies’ sites and apps. An advertising pixel on your page that feeds a retargeting campaign is sharing in this sense.

Personal information is defined widely too: anything that identifies, relates to or could reasonably be linked with a consumer or household, with IP address and online identifier in the first group of examples. The personal data examples post sets the EU and US lists side by side.

What I can’t tell from a page is whether you’re over the thresholds. Revenue and consumer counts don’t show in a browser. So I read the link, the signal and the notices as if the law applies, and leave that call to you.

The Do Not Sell or Share link

Section 1798.135(a)(1) asks a business that sells or shares personal information to provide a clear and conspicuous link on its internet homepages, titled “Do Not Sell or Share My Personal Information”, to a page where the visitor can opt out. A second link, “Limit the Use of My Sensitive Personal Information”, applies when sensitive data is used beyond the allowed purposes, and section 1798.135(a)(3) lets a business use a single clearly labelled link for both.

The regulations fill in the details:

• Where: Section 7013(c) puts the link in the header or footer of the homepage.
• What it can be called: Section 7013(d) allows the alternative opt-out link, Your Privacy Choices, in place of the long title.
• When you can skip it: Section 7013(g) says a business needs neither the link nor the notice if it does not sell or share personal information and says so in its privacy policy.
• What it can’t ask for: Section 1798.135(c)(1) says the business can’t require an account or more information than the opt-out needs.

The enforcement record here is the longest of the five items. In 2022 the Attorney General’s Sephora settlement alleged that the retailer didn’t tell consumers it was selling their personal information and didn’t honour opt-out requests sent through Global Privacy Control; the payment was $1.2 million. In 2025 the Attorney General’s Healthline settlement alleged that tracking kept running for people who had opted out, for $1.55 million. The CPPA’s Tractor Supply decision the same year alleged an opt-out that didn’t work, including for preference signals, and a policy that didn’t tell consumers their rights, for $1,350,000.

The Attorney General’s older enforcement examples are smaller and closer to what a small site gets wrong: a link that worked only in some browsers, a link that opened a cookie pop-up and nothing else, toggles so confusing that switching one on opted people in.

Global Privacy Control

Global Privacy Control is a setting in a browser or extension that sends an opt-out with every page load. Section 1798.135(b)(1) lets a business skip the link if it honours an opt-out preference signal sent with the consumer’s consent.

The CPPA’s FAQ is blunter: businesses must honor opt-out preference signals that meet the requirements, such as Global Privacy Control, as a valid request to opt out of sale or sharing. Regulation 7025(c) says a business that detects a compliant signal treats it as a valid opt-out for that browser or device and shall not require a consumer to provide additional information beyond what the signal carries.

The check is simple: turn the setting on in a browser, load your page, and see whether the ad requests still fire. US-03 is the Handbook article, and the cookie consent in the USA post covers how a US banner differs from an EU one.

The notice at collection and the privacy policy

The notice says what you’re taking right now. The policy says what you did with it last year.

The notice at collection

Section 1798.100(a) asks a business to tell consumers, at or before the point of collection, the categories of personal information collected, the purposes, whether it’s sold or shared, and how long each category is kept or the criteria for deciding. On a website that means a short line at the sign-up form, the checkout and the contact form, linking to the right section of the policy.

The Attorney General’s examples include a telehealth portal whose notice link led to the top of the policy rather than the right section. US-05 checks the forms on your public pages for exactly that.

What the privacy policy has to say

Section 1798.130(a)(5) lists what goes in the online privacy policy, updated at least once every 12 months:

• The rights: A description of the consumer’s rights and two or more ways to submit a request.
• The collection: Categories of personal information collected in the past 12 months, the sources, the purposes, and the categories of third parties it goes to.
• Two separate lists: Categories sold or shared in the past 12 months, and categories disclosed for a business purpose. A business that hasn’t sold or shared says so prominently.

The second list is where the DoorDash settlement sits. In 2024 the Attorney General alleged that the company sold names, addresses and transaction histories through marketing cooperatives while its policy didn’t say so; the penalty was $375,000. US-04 compares the advertising tools a page loads with what the policy says about selling and sharing. The privacy policy example post has a policy with these sections in place.

A request to know, delete or correct gets an answer within 45 calendar days, extendable once by another 45 with notice.

GDPR vs CCPA

People ask which is stricter. They’re different shapes.

• Who’s covered: The GDPR reaches any company that offers goods or services to people in the EU or monitors their behaviour there, with no size threshold. The CCPA starts at the thresholds above.
• Consent or opt-out: The GDPR wants a yes before non-essential tracking; consent is a freely given, specific, informed and unambiguous indication. The CCPA lets tracking run and gives the visitor a way to stop the selling and sharing.
• The clock: One month under the GDPR’s Article 12(3); 45 days under the CCPA.
• The link: The CCPA names a link title. The GDPR names none, and asks instead that withdrawing consent be as easy as giving it.

A site that serves both markets usually ends up with a consent banner for EU visitors and a footer link plus signal handling for US ones. The GDPR compliance checklist is the other half of this post.

The other state laws that copied it

The pattern since California has been opt-out rights plus a universal signal, with lower thresholds:

• Virginia: Applies at 100,000 consumers, or 25,000 consumers with over half of revenue from selling personal data.
• Connecticut: Applies at 35,000 consumers, and the Attorney General says all covered controllers must honour opt-out preference signals from 1 January 2025.
• Texas: No consumer count. It applies to a business in Texas that sells personal data and is not a small business under the SBA definition, and section 541.055(e) on global device settings took effect on 1 January 2025.
• Colorado: Senate Bill 21-190, signed on 7 July 2021, gives an opt-out right and told the Attorney General to set the technical rules for a universal opt-out mechanism.

US-11 tracks these. The practical answer is the same across them: one footer link, one signal handler, one policy that names each state.

Check your own site on a phone

No tool needed. Use a private window. If you only do two, do 1 and 6.

1. Open your homepage and scroll to the footer. Look for Do Not Sell or Share My Personal Information or Your Privacy Choices. Tap it. Note whether it opens a form or a page that says what to do.
2. Try to opt out without logging in. If it asks for an account, or for your address and date of birth, write that down.
3. Open the privacy policy and read the date at the top. Older than 12 months is a finding.
4. Search the policy for “sell” and “share”. You should find either a list of categories or a sentence that says you don’t.
5. Go to your sign-up or contact form. Look for a line about what’s collected and why, and tap its link. It should land on the matching section, not the top of the policy.
6. Turn on Global Privacy Control in a browser that has it, load your homepage, and look for an “Opt-Out Preference Signal Honored” message or toggle, which regulation 7025(c)(6) lets a business show. If nothing appears, that’s the question for your consent vendor.
7. Count the ways a person can send a request to know or delete. The policy should give at least two.

Date your answers. Items 1, 4 and 6 drift when a marketing tool is added, so do the walk again whenever one is.

Peeky reads the public pages of your site. For CCPA compliance, the checks are US-02 for the link, US-04 for the policy’s selling and sharing lines, and US-05 for the notice at collection in the Handbook.

Questions people ask

What does CCPA mean?

The California Consumer Privacy Act of 2018. Proposition 24, the CPRA, amended it, and the Attorney General says those changes began on 1 January 2023. People say CCPA, CPRA or both; it's one law.

Who does CCPA apply to?

A for-profit business that does business in California and meets one of three thresholds. The statute says gross revenue over $25 million, adjusted for inflation, and the CPPA puts the adjusted figure at $26.625 million from 1 January 2025. The other two: buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of revenue from selling or sharing it.

What is the Do Not Sell or Share My Personal Information link?

A link the statute names word for word, for a business that sells or shares personal information. The regulations put it in the header or footer of the homepage and let a business use Your Privacy Choices instead. Clicking it either opts the visitor out at once or opens the page where they can.

Is a cookie banner a CCPA opt-out?

Not on its own. In the Attorney General's enforcement examples, a clothing retailer's opt-out link opened only a cookie pop-up with no way to stop sales, and the company had to add a dedicated opt-out. Cookies are about collection; the link is about selling and sharing.

How long does a business have to answer a request?

The Attorney General's page says 45 calendar days, extendable by another 45 if the business tells the person. That covers requests to know, delete and correct. An opt-out request is different: it's acted on, not answered.