United States · California
CCPA/CPRA: cookies, sharing and Global Privacy Control
Why a European opt-in banner is not a complete California workflow and where GPC fits.
Start with the business practice
California analysis turns on what data is collected and whether it is sold or shared for cross-context behavioural advertising, not on the word “cookie” alone. Map each advertising and analytics vendor to the actual data flow and contract.
The CPRA amended the CCPA and the current framework gives eligible consumers rights including deletion, correction and opting out of sale or sharing.
Does CCPA require a cookie consent banner?
Start by checking whether your business falls within the CCPA’s scope. The presence of a California visitor or a cookie does not by itself settle applicability. Where the law applies, identify collection disclosures and whether each vendor receives personal information for sale or cross-context behavioral advertising.
An EU-style accept/reject interface may coexist with California rights controls, but an Analytics toggle does not automatically implement an opt-out of sale or sharing. The relevant outcome is a change to the covered data flow, including server events and vendor destinations.
Opt-out is a separate product requirement
A generic cookie settings panel may not satisfy a request to opt out of sale or sharing. California enforcement examples stress that businesses must provide an effective mechanism and honour the resulting choice across relevant technologies.
- Expose a clear “Do Not Sell or Share My Personal Information” path where required.
- Apply the choice to server-side and downstream sharing, not only browser cookies.
- Avoid dark patterns and unnecessary account creation.
- Keep the privacy notice aligned with the actual mechanism.
Recognise GPC
Global Privacy Control is a browser-level signal. Covered businesses should detect it and apply the relevant opt-out without forcing the visitor through an additional form.
Decide how GPC interacts with an existing logged-in preference and document the precedence rule. A privacy signal should not be overwritten by an unrelated consent banner action.
Translate the signal into a testable setup with the regional privacy signal configuration guide and record the resulting tag behavior.
Example: an advertising pixel and a GPC-enabled visitor
A covered business uses a pixel for cross-context behavioral advertising. When a qualifying GPC signal arrives, the business must apply the sale/sharing opt-out to that flow. Keeping a preference flag while continuing the same sharing is not an effective outcome.
Run the same landing page with GPC on and off. Compare the saved state, pixel destinations and server forwarding. Repeat after a reload and account sign-in. Investigate any step that restores sharing without a valid subsequent choice.
Operational test
Run a California test profile with and without GPC. Inspect browser and server events, advertising destinations and preference persistence. Capture evidence that the signal was received and enforced.