CCPA and CPRA Website Compliance: The Links, Notices and Signals California Requires

02

The CCPA checklist for websites

1. 01

   A privacy policy with the CCPA contents (§1798.100, .130; Regs §7011)

   Categories collected, purposes, sources, recipients, consumers' rights and how to use them. Update it at least every 12 months.

2. 02

   A notice at collection (§1798.100(a); Regs §7012)

   Where data is collected, such as a sign-up form, tell people what you collect and why, or link directly to that section of the policy.

3. 03

   "Do Not Sell or Share My Personal Information" (§1798.135)

   Needed when you sell personal information or share it for cross-context behavioural advertising, which most ad pixels do. The link must work and stop the sharing.

4. 04

   Honour Global Privacy Control (Regs §7025)

   When a browser sends the GPC signal, treat it as an opt-out of sale and sharing for that browser. California's 2022 settlement with Sephora was the first public enforcement on this point.

5. 05

   "Limit the Use of My Sensitive Personal Information" (§1798.121)

   Needed where sensitive data, such as precise location or health data, is used beyond what is necessary to provide the service.

6. 06

   Rights answered within 45 days (§1798.105 to .130)

   Know, delete, correct and opt out, with at least two ways to submit requests, including a toll-free number (a business that operates only online and has a direct relationship with the consumer may offer an email address instead).

7. 07

   Opt-in for under-16s (§1798.120(c))

   Selling or sharing data of consumers under 16 needs opt-in consent, from a parent for under-13s.

8. 08

   No dark patterns in consent flows (Regs §7004)

   Symmetry of choice: opting out can't take more steps than opting in, and choices can't be confusing or manipulative.

9. 09

   Contracts and security (§1798.100(d); §1798.150)

   Service-provider contracts with the required terms, and reasonable security, with a private right of action if a breach results from failing to maintain it.

03

What does CalOPPA require of every website?

• A conspicuously posted privacy policy (B&P §22575(a)).
• The categories of personal information collected and the third parties they're shared with (§22575(b)(1)).
• How users can review and correct their information, if you offer that (§22575(b)(2)).
• How the site responds to Do Not Track signals, and whether third parties track users across sites (§22575(b)(5) to (6)).
• An effective date and how users are told about changes (§22575(b)(3) to (4)).

04

How do I test Global Privacy Control on my site?

Use a browser or extension that sends GPC, open the site and check whether ad and sharing trackers still load. In code, the signal is available as navigator.globalPrivacyControl in the browser and the Sec-GPC: 1 request header on the server.

Make this change with a minimal diff.

When the visitor's browser sends Global Privacy Control
(navigator.globalPrivacyControl === true), treat it as an opt-out of sale and
sharing: don't load advertising pixels or cross-site tracking, and show
"Opt-out request honored" in the privacy settings. Store the opt-out so it
applies on later pages.

Done when:
- With GPC on, no advertising pixel requests are sent.
- The "Do Not Sell or Share My Personal Information" page shows the opt-out as active.

05

How SafeLaunch checks California

Choose California as a market and SafeLaunch applies the CCPA thresholds with the reason shown, checks the privacy policy against CCPA and CalOPPA contents, looks for the opt-out links where sharing trackers are present, and, on paid audits, records which advertising services load in a real browser. Texas, Virginia, Colorado, Florida and New York have their own checks too. Start with a free scan.