Updated October 7, 2026California CCPA / CPRAFor US businesses & marketers
What Is CCPA Compliant? Meaning, 2026 Requirements and a Checklist for US Businesses
Being CCPA compliant means meeting the California Consumer Privacy Act’s rules for how you collect, use, sell, share and protect Californians’ personal information. This guide explains who must comply, every obligation in plain English, the January 2026 regulation changes most guides still miss, real 2025–2026 fines, and exactly what to fix on your website, ad pixels and vendor contracts.
$26.6Mrevenue threshold (2025–26)100,000CA consumers or households$7,988max per intentional violation45 daysto answer a requestJan 1, 2027browser opt-out signal law
Get a free CCPA marketing checkJump to the checklist
Written by Chenna Reddy, Founder, Digital Masters 360 · Reviewed for accuracy against the California Civil Code §1798.100 et seq. and the CCPA regulations in force on October 7, 2026 · Not legal advice.
What Does CCPA Compliant Mean? (The 50-Word Answer)
CCPA compliant means a business covered by California’s Consumer Privacy Act gives California residents clear notice about their personal information, honors their rights to know, delete, correct, opt out of sale or sharing and limit sensitive data, honors Global Privacy Control signals, contracts properly with vendors, keeps data reasonably secure and never retaliates against people who use their rights.
Key Takeaways
- Not everyone must comply. Only for-profit businesses doing business in California that meet one of three thresholds: $26,625,000+ revenue, 100,000+ California consumers or households whose data is bought, sold or shared, or 50%+ of revenue from selling or sharing data.
- Ad pixels are the hidden trigger. Meta Pixel, TikTok Pixel and Google Ads remarketing usually count as ‘sharing’ for cross-context behavioral advertising.
- 2026 changed the details. Since January 1, 2026 you must show that an opt-out (including GPC) was honored, offer symmetric choices, and run risk assessments for high-risk processing.
- There is no CCPA certification. Compliance is proved by working controls and records, not badges.
- Enforcement is real and rising. Settlements in 2026 include $12.75 million (GM), $2.75 million (Disney), $1.1 million (PlayOn Sports) and $375,703 (Ford).
- GDPR compliance is not enough. CCPA has its own links, signals, timelines and contract terms.
In This Guide
- What is the CCPA?
- Who must be CCPA compliant?
- Quick test: does CCPA apply to you?
- Key definitions
- Consumer rights
- Business obligations
- What changed in 2026–2027
- CCPA for marketers: pixels, GA4, GPC
- 15-step checklist
- Fines and enforcement
- CCPA vs GDPR and other laws
- Vendors and ‘CCPA compliant’ claims
- Working with an offshore agency
- DM360 pricing
- Common mistakes
- FAQs
- Free CCPA marketing check
What Is the CCPA (California Consumer Privacy Act)?
The California Consumer Privacy Act of 2018 (CCPA) is a California state law, codified at California Civil Code §1798.100–1798.199.100, that gives California residents control over the personal information businesses collect about them. It was signed on June 28, 2018 as AB 375, took effect on January 1, 2020, and became enforceable by the California Attorney General on July 1, 2020.
In November 2020, California voters approved Proposition 24, the California Privacy Rights Act (CPRA). The CPRA amended and expanded the CCPA from January 1, 2023 and created the California Privacy Protection Agency, the first US agency dedicated to privacy. The agency now uses the public name CalPrivacy. When people say ‘CCPA’ today, they mean the law as amended by the CPRA, plus the regulations CalPrivacy has adopted under it.
CCPA Timeline: 2018 to 2028
| Date | What happened | Why it matters |
|---|---|---|
| June 28, 2018 | CCPA (AB 375) signed | Created the first comprehensive US state privacy law |
| January 1, 2020 | CCPA takes effect | Rights to know, delete and opt out of sale begin |
| July 1, 2020 | Attorney General enforcement begins | First settlement: Sephora, $1.2M (August 2022) |
| November 3, 2020 | Voters approve CPRA (Prop 24) | Adds ‘sharing’, correction, sensitive data rights, CalPrivacy |
| January 1, 2023 | CPRA amendments operative | Employee and B2B data fully covered; 12-month lookback rules change |
| July 1, 2023 | CalPrivacy enforcement authority begins | Two regulators now enforce CCPA |
| January 1, 2025 | Inflation adjustment | Revenue threshold $26,625,000; fines $2,663 / $7,988 |
| September 23, 2025 | New regulations approved | ADMT, risk assessments, cybersecurity audits, updated rules |
| January 1, 2026 | Updated regulations take effect; DROP opens | Opt-out status display, symmetry, risk assessments; data broker deletion platform |
| August 1, 2026 | Data brokers must process DROP deletions | Broker non-compliance carries daily fines |
| January 1, 2027 | ADMT rules and Opt Me Out Act (AB 566) | ADMT notices/opt-outs; browsers must offer an opt-out preference signal |
| April 1, 2028 | First risk-assessment attestations and cybersecurity audit certifications (revenue over $100M) | Compliance becomes filed, auditable evidence |
Who Enforces the CCPA?
Two regulators share enforcement: the California Attorney General (civil lawsuits and settlements, often joined by district attorneys) and CalPrivacy (administrative enforcement, plus a new Audits Division set up in 2026 that can examine any covered business). Consumers can also sue directly, but only after certain data breaches.
Is the CCPA a Federal Law?
No. The CCPA is California law. There is still no comprehensive federal US privacy law, so roughly 20 states have passed their own (Virginia, Colorado, Connecticut, Texas, Oregon and others). California’s remains the broadest and the most actively enforced.
Who Must Be CCPA Compliant? The Three Thresholds
The CCPA applies to a ‘business’: a for-profit legal entity that does business in California, collects consumers’ personal information (or has it collected on its behalf), decides why and how it is processed, and meets at least one of these thresholds:
| Threshold | Test (2025–2026 figures) | Typical businesses caught |
|---|---|---|
| 1. Revenue | Annual gross revenue above $26,625,000 in the preceding calendar year (worldwide revenue, not just California) | Mid-size and large retailers, SaaS, manufacturers, healthcare groups, franchisors |
| 2. Data volume | Annually buys, sells or shares the personal information of 100,000+ California consumers or households | High-traffic websites with ad pixels, apps, publishers, lead-gen sites, marketplaces |
| 3. Data revenue | Derives 50% or more of annual revenue from selling or sharing personal information | Data brokers, ad-tech, list sellers, some affiliate networks |
Do You Need an Office in California?
No. ‘Doing business in California’ is read broadly. Selling online to Californians, marketing to them or tracking their visits can be enough. A New York e-commerce brand, a Toronto SaaS company or a Hyderabad app studio can all be covered if they meet a threshold.
Who Is Exempt?
- Nonprofits and government agencies (unless a nonprofit is controlled by a covered business and shares common branding).
- Businesses below every threshold.
- Specific data, not whole companies: protected health information under HIPAA, data covered by the Gramm-Leach-Bliley Act (GLBA), consumer reports under the Fair Credit Reporting Act (FCRA), the Driver’s Privacy Protection Act and some clinical trial data. A hospital or bank can still be covered for its marketing and website data.
- Deidentified and aggregate consumer information, and publicly available information (as defined).
Service Providers, Contractors and Third Parties
If you process data for a covered business (an agency, SaaS tool, call center or developer), you are usually a service provider or contractor. You don’t need your own ‘Do Not Sell’ link for that data, but you must follow the contract, help with consumer requests and must not sell, share or reuse the data for your own purposes. If you receive data and use it for your own purposes, you are a third party, and the disclosure to you may be a ‘sale’ or ‘sharing’.
Joint Ventures and Common Branding
An entity that controls or is controlled by a covered business and shares common branding (a shared name, service mark or trademark) with it is also treated as a business if it receives personal information from it. Check parent and subsidiary brands together.
Quick Test: Does the CCPA Apply to Your Business?
Answer three questions. Nothing you click is stored or sent anywhere.
Key CCPA Definitions in Plain English
Most compliance mistakes start with misunderstood definitions. These are the ones that decide what you must do.
Personal Information
Information that identifies, relates to or could reasonably be linked with a particular consumer or household. That includes names, emails, phone numbers, IP addresses, cookie and device IDs, purchase history, browsing and search history, geolocation, audio and video, professional details and inferences drawn to build a profile.
Consumer
A natural person who is a California resident, including customers, website visitors, employees, job applicants, contractors and B2B contacts.
Sale vs Sharing
| Term | Legal meaning | Marketing example |
|---|---|---|
| Sale | Disclosing personal information to a third party for money or other valuable consideration | Renting an email list; letting a data partner reuse your customer data for its own purposes |
| Sharing | Disclosing personal information to a third party for cross-context behavioral advertising, paid or not | Meta Pixel, TikTok Pixel, Google Ads remarketing, LinkedIn Insight Tag and similar retargeting tags |
Why ‘Sharing’ Matters for Advertisers
Before 2023, companies argued that free pixels weren’t a ‘sale’. The CPRA closed that gap. If a pixel lets an ad platform track a visitor across other sites to target ads, that is sharing, and the visitor has the right to opt out.
Sensitive Personal Information
A protected subset: government IDs (SSN, driver’s license, passport), account log-ins with passwords, financial account and card numbers with access codes, precise geolocation (within roughly 1,850 feet), racial or ethnic origin, religious or philosophical beliefs, union membership, citizenship or immigration status, contents of mail, email and texts, genetic, biometric, health and neural data, and data about sex life or sexual orientation.
Business Purpose
Operational uses that are compatible with why you collected the data, such as security, debugging, short-term contextual ads, analytics for your own service, and processing by a service provider under contract.
Deidentified Information
Information that cannot reasonably be linked to a person, where you have technical safeguards, publicly commit not to reidentify it, and contractually bind recipients to the same.
Dark Patterns
Interfaces that subvert or impair a consumer’s choice, such as a bright ‘Accept’ button next to a hidden ‘Reject’, confirm-shaming language, or more steps to opt out than to opt in. Consent obtained through dark patterns is not valid consent.
The CCPA Consumer Rights You Must Honor
| Right | What the consumer can do | Your deadline |
|---|---|---|
| Right to know / access | Learn what personal information you collected, sources, purposes, who you disclosed it to, and get specific pieces in a portable format | Confirm in 10 business days; respond in 45 calendar days (+45 with notice) |
| Right to delete | Ask you to delete personal information you collected from them, subject to exceptions | Same as above; pass to service providers and third parties |
| Right to correct | Ask you to fix inaccurate information | Same as above |
| Right to opt out of sale/sharing | Stop you selling or sharing their data, including via a GPC signal | As soon as feasible, no later than 15 business days |
| Right to limit sensitive PI | Restrict use of sensitive data to what is necessary for the service | No later than 15 business days |
| Right to non-retaliation | Get the same price and service after exercising rights (loyalty programs allowed with a notice of financial incentive) | Ongoing |
| ADMT rights (from Jan 1, 2027) | Pre-use notice, opt-out and access for automated decision-making used for significant decisions | Before first use (existing uses by Jan 1, 2027) |
How Far Back Does the Right to Know Go?
The default is 12 months, but for information collected on or after January 1, 2022, a consumer can ask for more than 12 months unless that proves impossible or involves disproportionate effort. The 2026 regulations require businesses to give consumers a way to ask for that longer period.
Verifying Requests
You must make a reasonable effort to verify that the person asking to know, delete or correct is who they say they are, matching data you already hold. Don’t verify opt-outs (unless you suspect fraud) and don’t make people create an account just to exercise a right.
Authorized Agents
Consumers can use an authorized agent. You can ask for signed permission and, for requests to know, delete or correct, ask the consumer to verify their identity directly.
Children and Teens
You may not sell or share the data of consumers you know are under 16 unless they (ages 13–15) or a parent (under 13) opt in. Willful disregard of age counts as actual knowledge, and violations involving minors carry the higher $7,988 fine.
What a CCPA Compliant Business Must Do: 10 Core Obligations
1. Publish a CCPA-Compliant Privacy Policy
Describe the categories of personal information collected in the last 12 months, sources, business purposes, categories of recipients, whether you sell or share (and to whom), retention periods for each category, how to exercise every right, and your request metrics if you handle data on 10 million+ Californians. Update it at least every 12 months.
2. Give a Notice at Collection
At or before the point of collection (forms, checkout, apps, call recordings, connected devices) tell people what you collect, why, whether it is sold or shared, and how long you keep it, with a link to the full policy.
3. Offer Opt-Out Links
Show a ‘Do Not Sell or Share My Personal Information’ link and, if you use sensitive data beyond what is permitted, a ‘Limit the Use of My Sensitive Personal Information’ link. You can combine them into one ‘Your Privacy Choices’ link with the official toggle icon.
4. Honor Opt-Out Preference Signals (GPC)
Treat Global Privacy Control as a valid opt-out of sale and sharing for that browser and any profile you can link to it, and display that you honored it.
5. Provide at Least Two Request Methods
Usually including a toll-free number. A business that operates exclusively online and has a direct relationship with the consumer may offer only an email address. Handle requests within the deadlines above and keep records for 24 months.
6. Practice Data Minimization and Purpose Limitation
Collect, use and keep only what is reasonably necessary and proportionate for the disclosed purpose. CalPrivacy calls these principles fundamental, and the 2026 GM settlement was described as California’s first data-minimization case.
7. Sign the Right Contracts
Service provider, contractor and third-party agreements must include CCPA-specific terms (see the vendor section below). Without them, a disclosure to a vendor may be treated as a sale.
8. Keep Data Reasonably Secure
Use security appropriate to the data: access controls, MFA, encryption, logging, patching and vendor oversight. A breach of certain data caused by unreasonable security opens you to consumer lawsuits.
9. Don’t Use Dark Patterns or Retaliate
Make choices symmetric and plain, and don’t charge more or downgrade service because someone opted out (except under a disclosed, fair financial incentive program).
10. Assess Risk and Train Staff
Run documented risk assessments before high-risk processing (from January 1, 2026), train anyone who handles consumer requests, and review your program at least yearly.
What ‘Reasonable Security’ Looks Like in Practice
- Multi-factor authentication on email, ad accounts, CRM and hosting
- Role-based access and quarterly access reviews
- Encryption in transit and at rest for customer data
- Vendor security reviews and breach-notice clauses
- An incident response plan tested at least once a year
What Changed in 2026 and What’s Coming in 2027–2028
Most pages ranking for ‘what is CCPA compliant’ were written before these rules took effect. Here is what is new.
Updated Rules in Force Since January 1, 2026
| Change | What you must do now |
|---|---|
| Opt-out confirmation is mandatory | Show the status of an opt-out, including a GPC signal, e.g. ‘Opt-Out Request Honored’ or a toggle in privacy settings |
| Symmetry in choice | Opting out must take no more steps than opting in; equal visual weight for ‘Accept’ and ‘Reject’ |
| Closing a banner is not consent | Clicking ‘X’ on a pop-up cannot be treated as agreement |
| Known users and GPC | If you know who the user is, a later visit without GPC does not opt them back in |
| Expanded right to know | Offer a way to request information beyond 12 months |
| Privacy policy detail | Clearer disclosures, including where you link the policy in apps and connected devices |
| Risk assessments | Required before selling/sharing data, processing sensitive data, using ADMT for significant decisions and some AI training uses |
Risk Assessments (Effective January 1, 2026)
Before high-risk processing, document the purpose, categories of data, benefits, negative impacts, safeguards and who approved it. Assessments for processing that started before 2026 and continues must be completed by December 31, 2027. The first attestation and summary are due to CalPrivacy by April 1, 2028. CalPrivacy has already made a risk assessment a remedial term in an enforcement case (PlayOn Sports, March 2026).
Automated Decision-Making Technology (from January 1, 2027)
If you use ADMT to make significant decisions about people (lending, housing, employment, education, healthcare and similar), you’ll need a pre-use notice, an opt-out or an appeal route, and access rights. Cookie banners don’t satisfy these duties.
Cybersecurity Audits
| Revenue (prior year) | First certification due |
|---|---|
| Over $100 million | April 1, 2028 |
| $50–100 million | April 1, 2029 |
| Under $50 million | April 1, 2030 |
Audits apply to businesses whose processing presents significant security risk: those earning 50%+ of revenue from selling or sharing data, or meeting the revenue threshold and processing the data of 250,000+ consumers or the sensitive data of 50,000+ consumers.
California Opt Me Out Act (AB 566), January 1, 2027
Signed October 8, 2025, it requires every browser to offer a built-in, easy-to-find opt-out preference signal. Expect opt-out signals from Chrome, Safari and Edge users, not just Firefox and Brave. If your tags don’t respond to GPC today, revenue from retargeting audiences will drop suddenly and the compliance gap will be obvious to regulators.
The Delete Act and DROP
Since January 1, 2026, Californians can send one deletion request to every registered data broker through CalPrivacy’s Delete Request and Opt-Out Platform (DROP). Brokers had to start processing those requests by August 1, 2026, with daily fines for each unprocessed request. If you buy data from brokers, expect smaller, cleaner lists.
What Hasn’t Changed
The three thresholds, the core rights, the 45-day deadline and the per-violation fine amounts stay the same until the next inflation adjustment, due January 2027.
CCPA for Marketers: Pixels, GA4, Email and GPC
This is where most US businesses actually fail. Regulators now test whether opt-outs work, not whether a link exists. The Healthline, Disney, Ford and Honda cases were all about tracking and opt-out flows.
How Common Marketing Tools Map to the CCPA
| Tool | Usually a sale/share? | What to configure |
|---|---|---|
| Meta Pixel / Conversions API | Sharing | Disclose; stop on opt-out/GPC; use Meta’s Limited Data Use (LDU) flag for California opt-outs |
| Google Ads remarketing / Floodlight | Sharing | Disclose; enable restricted data processing for opted-out users; stop remarketing tags on GPC |
| Google Analytics 4 | Usually a service provider use | Accept Google’s data processing terms; turn off Google signals and ad personalization for opted-out users |
| TikTok Pixel, LinkedIn Insight, X Pixel | Sharing | Block on opt-out/GPC through your tag manager |
| Email platform (Klaviyo, Mailchimp, HubSpot) | Service provider if contracted | Signed DPA; don’t upload opted-out users to ad audiences |
| Customer Match / Custom Audiences uploads | Often sharing | Exclude opted-out and limit-request contacts before every upload |
| Affiliate and influencer tracking | Depends on the contract | Check whether partners reuse data; add CCPA terms |
| Live chat and session replay | Depends on vendor use | Mask form fields; confirm service-provider terms; disclose recording |
How to Detect and Honor Global Privacy Control
GPC is exposed to websites as navigator.globalPrivacyControl === true and as the HTTP header Sec-GPC: 1. A compliant setup does four things:
- Reads the signal before any advertising tag loads.
- Blocks or switches to restricted mode every ‘sharing’ tag (pixels, remarketing, audience uploads).
- Records the opt-out against the logged-in account or known email, so it follows the user across devices.
- Displays the status, for example a toggle showing ‘Sale/Sharing: Off — your GPC signal was honored’.
How to Test Your Site in 10 Minutes
Turn on GPC in Firefox, Brave or the DuckDuckGo extension, open your site with browser developer tools, and watch the Network tab. If requests still go to facebook.com/tr, googleadservices.com or analytics.tiktok.com, you are not honoring the signal.
Server-Side Tracking Is Not a Loophole
Moving pixels to server-side tagging or the Conversions API doesn’t change the law. If the data still reaches an ad platform for cross-context behavioral advertising, it is sharing and must stop on opt-out.
Pro Tip for E-commerce
Keep a ‘privacy suppression list’ in your CRM that syncs to every ad platform’s exclusion audience nightly. It is the simplest way to stop opted-out customers being re-uploaded by accident.
CCPA and Email or SMS Marketing
CCPA does not require opt-in consent for email; that is governed by CAN-SPAM (email) and the TCPA (calls and texts). But email addresses are personal information, so list rentals count as sales, and uploading subscribers to ad platforms can count as sharing.
Does My WordPress Site Need Anything Special?
WordPress isn’t compliant or non-compliant by itself. What matters is the plugins and tags. Use a consent platform that supports GPC and US state laws, load marketing tags through Google Tag Manager with consent triggers, and check forms (Contact Form 7, Gravity Forms, WPForms) for notice-at-collection text.
CCPA Compliance Checklist: 15 Steps for 2026
Work through these in order. Steps 1–3 tell you the size of the job; steps 7–9 are where regulators look first.
Step 1: Confirm whether you are covered
Check all three thresholds for the last calendar year, including pixel-driven ‘sharing’ volumes. Document the result.
Step 2: Map your data
List every category of personal information, source, system, purpose, recipient and retention period, including employee and B2B data.
Step 3: Classify every vendor
Mark each as service provider, contractor or third party, and flag every disclosure that is a sale or sharing.
Step 4: Fix your contracts
Add CCPA terms to every service provider, contractor and third-party agreement.
Step 5: Rewrite your privacy policy
Cover all required disclosures and set a 12-month review date.
Step 6: Add notices at collection
Forms, checkout, apps, call recordings, events and job applications.
Step 7: Install opt-out links
‘Do Not Sell or Share’ and ‘Limit’ links, or a ‘Your Privacy Choices’ link, in the footer and app settings.
Step 8: Honor and display GPC
Detect the signal, block sharing tags, link to known profiles and show the status.
Step 9: Fix banner symmetry
Equal ‘Accept’ and ‘Reject’ options; closing the banner does nothing.
Step 10: Build a request workflow
Two intake methods, verification, 10-day confirmation, 45-day response, vendor pass-through and logs kept 24 months.
Step 11: Limit sensitive data
Stop non-essential uses or offer the ‘Limit’ right.
Step 12: Check minors
Opt-in before selling or sharing data of under-16s; audit age signals.
Step 13: Run risk assessments
Before selling/sharing, sensitive data processing, ADMT and AI training; prepare for the April 2028 attestation.
Step 14: Secure the data
MFA, least privilege, encryption, logging, incident response plan.
Step 15: Train, test and repeat
Train staff, test opt-outs monthly with GPC on, and review the whole program yearly.
Free Official Resources
- CalPrivacy — CCPA regulations
- California Attorney General — CCPA overview
- Global Privacy Control — implementation guide
- California Civil Code Title 1.81.5 (the statute)
CCPA Fines, Penalties and Real Enforcement Cases
| Penalty type | Amount (2025–2026 inflation-adjusted) | Who imposes it |
|---|---|---|
| Administrative fine / civil penalty | Up to $2,663 per violation | CalPrivacy / Attorney General |
| Intentional violation or minor’s data | Up to $7,988 per violation | CalPrivacy / Attorney General |
| Data breach statutory damages | $107–$799 per consumer per incident, or actual damages if higher | Consumers (private lawsuit) |
| Data broker (Delete Act) | $200 per day per unprocessed deletion request, plus registration penalties | CalPrivacy |
Because each affected consumer can be a separate violation, totals grow quickly. There is no automatic 30-day cure for regulators, so fixing a problem after an inquiry doesn’t erase it.
Notable CCPA Settlements, 2022–2026
| Company | Date | Amount | Main issue |
|---|---|---|---|
| General Motors | May 2026 | $12,750,000 | Sale of driving data; data minimization (AG, district attorneys and CalPrivacy) |
| Ford Motor Company | March 2026 | $375,703 | Unnecessary friction in the opt-out process (CalPrivacy) |
| PlayOn Sports (GoFan) | March 2026 | $1,100,000 | Student data; opt-out failures; mandatory risk assessment (CalPrivacy) |
| The Walt Disney Company | February 2026 | $2,750,000 | Failing to honor opt-outs across services and devices (AG) |
| Tractor Supply | September 2025 | $1,350,000 | Job applicant data, privacy notices and opt-outs (CalPrivacy) |
| Healthline Media | July 2025 | $1,550,000 | Sharing health-related article data for ads; opt-out failures (AG) |
| Todd Snyder | May 2025 | $345,178 | Misconfigured opt-out tool; excessive verification (CalPrivacy) |
| American Honda Motor Co. | March 2025 | $632,500 | Excess data for opt-outs; asymmetric cookie choices (CalPrivacy) |
| Sephora | August 2022 | $1,200,000 | Undisclosed sale via trackers; ignored GPC (AG) |
What These Cases Teach
- Opt-outs must work across every brand, device and service you link to the person (Disney).
- Don’t ask for more data to opt out than you need (Honda, Todd Snyder).
- Your vendor’s broken tool is your violation (Todd Snyder).
- Health-adjacent content and kids’ data attract attention (Healthline, PlayOn).
- Employee and applicant data count (Tractor Supply).
CCPA vs GDPR vs Other Privacy Laws
| Feature | CCPA / CPRA (California) | GDPR / UK GDPR | Australian Privacy Act 1988 | India DPDP Act 2023 |
|---|---|---|---|---|
| Who is covered | For-profit businesses meeting thresholds | Almost all controllers and processors | Most organizations with A$3M+ turnover, plus some smaller ones | Data fiduciaries processing digital personal data |
| Default model | Opt-out of sale/sharing | Lawful basis needed (often opt-in consent) | Notice plus consent for some uses | Consent or legitimate uses |
| Cookie consent | Not required before setting; opt-out + GPC | Prior consent for non-essential cookies (ePrivacy/PECR) | No specific cookie law; APP notices apply | Consent framework |
| Browser signal | GPC must be honored and displayed | Not mandated | Not mandated | Not mandated |
| Regulator | CalPrivacy + Attorney General | EU DPAs / UK Information Commission | OAIC | Data Protection Board of India |
| Maximum penalty | $2,663 / $7,988 per violation | Up to €20M or 4% of global turnover (UK £17.5M) | Up to A$50M or more | Up to ₹250 crore |
| Private lawsuits | Data breaches only | Yes, for damage | New statutory tort for serious invasions | No |
If I’m GDPR Compliant, Am I CCPA Compliant?
Not automatically. You’ll be well placed on data mapping, security and access requests, but you still need the CCPA’s specific links, the GPC display rule, CCPA-format privacy policy disclosures, the 45-day timelines and CCPA contract language.
Other US State Privacy Laws
Around 20 states now have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska, with Oklahoma following from January 1, 2027. Many also require honoring opt-out preference signals. Building to the California standard covers most of their requirements, but thresholds, sensitive-data consent rules and appeal processes differ.
Spelling Note for UK and Australian Readers
This page uses US spelling because the CCPA is a US law. UK and AU equivalents: ‘honor’ → ‘honour’, ‘behavioral’ → ‘behavioural’, ‘minimization’ → ‘minimisation’, ‘organization’ → ‘organisation’.
Vendors, Agencies and What ‘CCPA Compliant’ Really Means on a Sales Page
When a SaaS tool or agency says it is ‘CCPA compliant’, ask what that means in contract terms. Under the CCPA a service provider or contractor agreement must:
- Specify the limited business purpose for processing
- Prohibit selling or sharing the personal information
- Prohibit using it outside the direct relationship or combining it with other data (with narrow exceptions)
- Require the vendor to comply with the CCPA and give the same level of privacy protection
- Let you take reasonable steps to ensure compliance and to stop and fix unauthorized use
- Require the vendor to tell you if it can no longer meet its obligations
- Flow the same terms down to subcontractors (contractors must also certify they understand the restrictions)
7 Questions to Ask Any Vendor
- Will you sign our CCPA service provider addendum, or provide yours?
- Do you sell, share or use our data to improve products for others?
- How do you pass through deletion and correction requests, and how fast?
- Who can access our data, from which countries, and with what controls?
- How quickly will you notify us of a security incident?
- Which subprocessors do you use?
- Can you return or delete all data when we end the contract?
Is a ‘CCPA Compliant’ Badge Worth Anything?
Only as a prompt to ask for the contract. A badge isn’t evidence; the addendum, the access controls and the request-handling logs are.
Working With an Offshore Agency on CCPA-Covered Data
Digital Masters 360 is a Hyderabad-based digital marketing agency serving US, UK, Canadian and Australian businesses 100% online. Here is exactly how we handle the questions US buyers ask before trusting an offshore partner with customer data.
Is It Legal to Use an Agency in India Under the CCPA?
Yes. The CCPA has no data localization rule and doesn’t restrict transfers abroad. It requires the service-provider contract described above, reasonable security and request pass-through. We act as your service provider, never a third party, and we never sell or share your data.
How We Handle Your Data
- We work inside your accounts (Google Ads, Meta, GA4, HubSpot, Shopify) through named, role-based access, so your data stays in your systems.
- Least privilege: analysts get read-only access unless a task needs edit rights.
- MFA on every login and company-managed devices with full-disk encryption.
- No customer lists on personal drives; audience files are processed in your platforms or a shared, access-logged folder you control.
- 24-hour incident notice to your named contact.
Offboarding
Within 2 business days of the contract ending we remove our users from your accounts, delete working files and confirm in writing.
Tip: Revoke Access Yourself Too
Remove agency users from your ad and analytics accounts on day one of offboarding; don’t rely on any vendor alone.
Cost Savings vs a Local US Agency
| Service (monthly) | Typical US agency | DM360 (USD) | DM360 (GBP) | DM360 (EUR) | DM360 (AUD) |
|---|---|---|---|---|---|
| Starter SEO / paid social | $1,500–$3,000 | $649 | £495 | €575 | A$990 |
| Growth (SEO + ads + reporting) | $3,000–$6,000 | $1,249 | £950 | €1,100 | A$1,890 |
| Scale (multi-channel) | $6,000–$12,000 | $2,390 | £1,800 | €2,090 | A$3,590 |
| One-off CCPA marketing & tracking audit | $2,500–$7,500 | $990 | £750 | €870 | A$1,490 |
| White-label partner seat | — | from $499 | from £395 | from €460 | from A$750 |
Savings come from Hyderabad’s lower operating costs, not from skipping controls. A CCPA tag audit is the same work whoever does it; we just charge less for it.
Time Zones and Communication
| Your time zone | Live overlap with our team | How we work |
|---|---|---|
| Eastern (ET) | 9:00 am–5:00 pm ET (6:30 pm–2:30 am IST during US daylight time) | Daily Slack, weekly Zoom |
| Central (CT) | 8:00 am–4:00 pm CT | Same-day replies |
| Mountain (MT) | 7:00 am–3:00 pm MT | Morning calls |
| Pacific (PT) | 6:00 am–2:00 pm PT | Early calls; async updates ready when you start |
Slack replies within 4 business hours, a monthly report by the 5th business day, and a named account lead on every account.
Contracts, NDAs, Payments and Onboarding
- Contracts: master services agreement plus a CCPA service provider addendum (and GDPR/UK GDPR terms where needed). Mutual NDA before any account access.
- Payments: USD invoices by wire, Wise, PayPal or card; GBP, EUR and AUD invoices on request. Monthly in advance; no long lock-ins.
- Onboarding in 14 days: kickoff call, access set-up, tracking and CCPA tag audit, 90-day plan, first report.
White-Label Partnerships for US Agencies
US agencies can resell our SEO, PPC, tracking and CCPA-ready tag audits under their own brand. We sign your NDA and your service-provider terms, work in your client accounts under your branding, and never contact your clients directly.
DM360 CCPA-Ready Marketing Packages
CCPA Marketing Audit$990
One-off. GPC test, tag and pixel map, opt-out flow review, banner symmetry check, vendor list, prioritized fix plan to share with your lawyer.
Growth$1,249/mo
SEO + paid ads with privacy-safe tracking: GTM consent triggers, GPC handling, restricted data processing, suppression lists, monthly reporting.
White-Label Partnerfrom $499/mo
For US agencies: our team, your brand. NDA and service-provider addendum included.
What Every Package Includes
- CCPA service provider addendum and mutual NDA
- Least-privilege access inside your accounts
- GPC-aware tag set-up for any tags we manage
- Monthly report and Slack support
What We Don’t Do
We’re marketers and tracking specialists, not lawyers. We don’t draft legal advice or sign off on your privacy policy; we implement and test the technical side and work alongside your counsel.
10 Common CCPA Compliance Mistakes
- Assuming you’re too small, without counting pixel ‘sharing’ volumes.
- Adding a ‘Do Not Sell’ link that doesn’t actually stop any tags.
- Ignoring GPC, or honoring it without displaying the status.
- Asking for ID documents or a log-in before accepting an opt-out.
- Asymmetric banners: one-click ‘Accept’, three-click ‘Reject’.
- Forgetting employee, applicant and B2B data.
- No CCPA terms in agency, SaaS and affiliate contracts.
- Not updating the privacy policy for 12+ months.
- Re-uploading opted-out customers to Custom Audiences or Customer Match.
- Believing a vendor’s ‘CCPA compliant’ badge transfers compliance to you.
Glossary
| Term | Meaning |
|---|---|
| CPRA | California Privacy Rights Act (Prop 24), which amended the CCPA |
| CalPrivacy / CPPA | California Privacy Protection Agency |
| GPC | Global Privacy Control, a browser opt-out preference signal |
| OOPS | Opt-out preference signal (the legal term covering GPC) |
| ADMT | Automated decision-making technology |
| DROP | Delete Request and Opt-Out Platform for data brokers |
| SPI | Sensitive personal information |
| Cross-context behavioral advertising | Targeting ads using activity across other businesses’ sites and apps |
Frequently Asked Questions About CCPA Compliance
What does CCPA compliant mean?
CCPA compliant means a business that is covered by the California Consumer Privacy Act (as amended by the CPRA) meets the law’s obligations: it tells California residents what personal information it collects and why, honors their requests to know, delete, correct and opt out (including Global Privacy Control signals), limits use of sensitive data, signs required contracts with vendors, keeps data reasonably secure and does not penalize people for using their rights. A vendor that says it is ‘CCPA compliant’ usually means it can act as your service provider or contractor under a CCPA-compliant contract.
Is there an official CCPA certification?
No. Neither the California Attorney General nor the California Privacy Protection Agency (CalPrivacy) issues a CCPA certification, seal or badge. ‘CCPA certified’ badges are marketing. Compliance is shown by your notices, request-handling records, contracts, risk assessments and, for larger businesses, cybersecurity audit certifications filed with CalPrivacy from 2028.
Who has to be CCPA compliant?
A for-profit business that does business in California, collects California residents’ personal information and meets at least one threshold: annual gross revenue above $26,625,000 in the preceding calendar year; buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or earning 50% or more of annual revenue from selling or sharing personal information. Location does not matter; an Indian, UK or Australian company can be covered.
Does CCPA apply to small businesses?
Only if a small business meets a threshold. Most small businesses fall below $26.6 million in revenue, but a busy website running ad pixels can ‘share’ data about 100,000 Californians a year without anyone noticing, which brings the business into scope. Small businesses below every threshold are not covered, though their larger clients may contractually require CCPA-style terms.
Does CCPA apply to companies outside California or the US?
Yes, if the company does business in California and meets a threshold. Physical presence is not required. US companies in other states, and companies in India, the UK, Canada or Australia that sell to or track Californians at scale, can all be covered.
What are the CCPA thresholds in 2026?
Gross revenue above $26,625,000 (inflation-adjusted on January 1, 2025, from the original $25 million), or 100,000+ California consumers or households whose personal information is bought, sold or shared, or 50%+ of revenue from selling or sharing personal information. The next inflation adjustment is due in January 2027.
What are the penalties for not being CCPA compliant?
Administrative fines and civil penalties of up to $2,663 per violation, or $7,988 per intentional violation or violation involving a consumer known to be under 16 (2025 inflation-adjusted figures). Each affected consumer can be a separate violation. After a data breach caused by unreasonable security, consumers can sue for $107 to $799 per consumer per incident or actual damages. Recent settlements include $12.75 million (General Motors, May 2026) and $2.75 million (Disney, February 2026).
Is there still a 30-day cure period under CCPA?
Not for regulators. The CPRA removed the automatic 30-day cure period for Attorney General and CalPrivacy enforcement, so fixing a problem after you are contacted does not guarantee you avoid a fine. A 30-day notice-and-cure step still applies before consumers can seek statutory damages in data breach lawsuits.
What is the difference between CCPA and CPRA?
The CCPA is the original 2018 law (effective January 1, 2020). The California Privacy Rights Act (Proposition 24, approved November 2020, operative January 1, 2023) amended and expanded it, adding the right to correct, the right to limit sensitive personal information, ‘sharing’ for cross-context behavioral advertising, data minimization, and the California Privacy Protection Agency. Today people say ‘CCPA’ to mean the law as amended by the CPRA.
How do I know if my website is CCPA compliant?
Check five things: a privacy policy updated within the last 12 months; a notice at collection where data is gathered; a ‘Do Not Sell or Share My Personal Information’ or ‘Your Privacy Choices’ link that works; Global Privacy Control detection that actually stops ad pixels and shows an opt-out status; and a tested way to submit and fulfill requests to know, delete and correct within 45 days. Test with GPC turned on in your browser and watch which tags still fire.
Does CCPA require a cookie banner?
Not as such. CCPA is an opt-out law for most data, so it does not require prior consent for cookies the way GDPR does. It does require notice at collection, an opt-out of selling and sharing, and honoring opt-out preference signals. If you use a banner, the 2026 regulations require symmetric choices, and simply closing the banner cannot be treated as consent.
What is Global Privacy Control and must I honor it?
Global Privacy Control (GPC) is a browser signal that tells websites a visitor opts out of the sale and sharing of their data. Covered businesses must treat it as a valid opt-out request, and since January 1, 2026 they must display that the signal was processed (for example, ‘Opt-Out Request Honored’). From January 1, 2027 the California Opt Me Out Act requires browsers to offer this signal, so volumes will rise.
How long do I have to respond to a CCPA request?
Confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days, extendable once by another 45 days with notice. Opt-out and limit requests must be acted on as soon as feasibly possible and no later than 15 business days.
Do CCPA rights apply to employees and B2B contacts?
Yes. Since January 1, 2023, employee, job applicant and business-to-business personal information is fully covered. CalPrivacy’s $1.35 million Tractor Supply settlement in 2025 involved job applicant data, and the Attorney General ran an employer-focused sweep.
What is sensitive personal information under CCPA?
It includes Social Security, driver’s license and passport numbers; account log-ins with passwords; precise geolocation; racial or ethnic origin; religious beliefs; union membership; citizenship or immigration status; the contents of mail, email and texts not addressed to you; genetic, biometric, health and neural data; and information about sex life or sexual orientation. Consumers can limit how you use it.
Is Google Analytics CCPA compliant?
Google Analytics can be used in a CCPA-compliant way, but no tool is compliant on your behalf. Disclose it in your privacy policy, accept Google’s data processing terms, turn on restricted data processing for opted-out users and California traffic where appropriate, and make sure Google signals and ad-linked features stop when a visitor opts out or sends GPC.
What is the difference between CCPA and GDPR?
GDPR (EU and UK) needs a lawful basis such as consent before processing and applies to almost any organization handling EU residents’ data. CCPA covers only businesses meeting California thresholds and mainly gives people the right to know and to opt out. GDPR fines can reach 4% of global turnover; CCPA penalties are per violation. Being GDPR compliant does not make you CCPA compliant, because GDPR has no ‘Do Not Sell or Share’ link or GPC display rule.
Can an offshore marketing agency in India work on CCPA-covered data?
Yes. CCPA does not restrict sending data abroad. What it requires is a written service provider or contractor contract that limits the agency to your business purpose, bans selling or sharing the data, requires the same level of protection, allows you to take reasonable steps to stop unauthorized use, and makes the agency notify you if it can no longer comply. Digital Masters 360 signs these terms as standard and works inside your accounts with least-privilege access.
What new CCPA rules apply in 2026 and 2027?
From January 1, 2026: mandatory opt-out status display, symmetric consent choices, closing a banner is not consent, expanded right to know, and risk assessments before high-risk processing (attestations due April 1, 2028). From January 1, 2027: automated decision-making technology (ADMT) notices, opt-out and access rights, and browsers must offer an opt-out preference signal. Cybersecurity audit certifications start April 1, 2028 for businesses over $100 million in revenue.
Get a Free CCPA Marketing Check
Send us your website URL. Within 3 business days, we’ll test it with Global Privacy Control turned on and send you a short report: which tags still fire, whether your opt-out link works, and whether your banner choices are symmetric. Free, no obligation.
Email chennareddy819@gmail.comWhatsApp +91 9505971747
Digital Masters 360 · Hyderabad, India · Serving the US, UK, Canada, Australia, New Zealand, Ireland and Europe 100% online.
About the Author
Chenna Reddy is the founder of Digital Masters 360, a Hyderabad digital marketing agency that runs SEO, paid media and privacy-safe tracking for businesses in the US, UK, Canada and Australia.
Disclaimer
This guide is general information about the California Consumer Privacy Act as of October 7, 2026, not legal advice. Laws, regulations and inflation-adjusted amounts change; confirm your obligations with a qualified privacy attorney.
Sources
- California Privacy Protection Agency (CalPrivacy)
- California Attorney General — CCPA
- DLA Piper — 2025 updated CCPA regulations
- Covington Inside Privacy — updates to existing CCPA regulations
- Hunton — staggered CCPA deadlines
- IAPP — California Opt Me Out Act
- Freeman Mathis & Gary — 2025 CCPA fine adjustments
- Privacy Law Map — CCPA penalties tracker