What is CCPA?
The California Consumer Privacy Act gives people in California rights over the personal data businesses hold about them, including the right to opt out of their data being sold or shared.
The core idea
CCPA, now strengthened by the CPRA, is the main US state privacy law. Unlike GDPR, it is largely an opt-out model: businesses can collect data by default, but must let consumers say "do not sell or share my personal information". For tracking, "share" explicitly includes passing identifiers to ad networks for cross-context advertising.
Who it applies to
Businesses that meet certain thresholds (revenue, volume of data, or selling data) and handle the data of California residents. Plenty of non-US companies are caught simply because they have California visitors.
GDPR vs CCPA for your site
- GDPR/UK: opt-in. No analytics or marketing cookies until the visitor agrees.
- CCPA: opt-out. You can track by default, but must honour a "Do Not Sell or Share" signal, including the Global Privacy Control.
Many businesses run one consent setup that handles both regions, showing an opt-in banner in Europe and an opt-out link in California. Consent Mode and a good banner make that manageable.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Tracking when users reject cookies