CCPA / CPRA
California Consumer Privacy Act
California does not require agreement before tracking, but an effective right to object. Miss that distinction and you build the wrong banner — and may be ignoring a signal that is legally binding.
CCPA / CPRA at a glance
- In force
- Since 1 January 2020
- Supervision
- California Privacy Protection Agency
- Penalty
- USD 2,500 per violation, USD 7,500 if intentional
- Model
- Opt-out of sale and sharing
What is the CCPA?
The California Consumer Privacy Act gives people in California the right to learn what data is collected about them, to have it deleted and to object to its sale and sharing. The extension through the California Privacy Rights Act has applied since 2023 and created a dedicated supervisory body, the California Privacy Protection Agency.
The term "sale" is broader than it sounds: it covers passing data to advertising networks without any money changing hands. Anyone running advertising tracking is generally covered.
Who does the CCPA apply to?
Over 25 million dollars annual revenue
The threshold applies company-wide, not only to Californian business.
Data on 100,000 people or households
A high-traffic website reaches this threshold faster than expected, because mere visits count.
More than half of revenue from selling data
This mainly concerns ad-funded services and data brokers.
What does the CCPA require of a website?
A visible opt-out route
An entry point reading "Do Not Sell or Share My Personal Information" has to be reachable without detours.
Honour browser signals
Global Privacy Control is a legally binding objection. Receiving it and ignoring it is a violation.
No discrimination
Anyone who objects must not receive a worse service or a higher price.
Access and deletion
Requests have to be answered within 45 days, with the option of an extension.
Sensitive data disclosures
For particularly sensitive categories there is an additional right to limit their use.
How does Aiara meet the CCPA?
For US audiences, Aiara switches from the consent model to the opt-out model — and targets exactly the categories the law is about.
A dedicated interface for the objection
Instead of a consent banner, a "Your Privacy Choices" panel appears, as Californian law envisages.
Global Privacy Control is honoured
If the browser sends the signal, the objection applies immediately — without asking. The corresponding switch is locked so later agreement cannot override it.
Only marketing is switched off
The objection targets sale and sharing, not your own audience measurement. Aiara therefore switches off marketing specifically rather than everything — you keep the data you are allowed to keep.
Signals forwarded via the Global Privacy Platform
The decision is transmitted as a standardised string to advertising partners, so they learn of the objection too.
Nationwide coverage without geolocation
Aiara uses the national section of the standard, which maps the requirements of every US state. That removes the need for error-prone state detection.
Frequently asked questions about CCPA / CPRA
Official sources
This page summarises the legal position in plain language and is no substitute for legal advice.