Sign in
Start free

United States

CCPA

California Consumer Privacy Act

The CCPA gives California residents the right to know what personal information businesses collect about them and the right to opt out of the sale or sharing of that information. For cookies, this means a clear opt-out mechanism rather than the GDPR’s opt-in consent.

Start free
Run a free scan

At a glance

Opt-out

Region
California, USA
Status
In force since January 2020
Penalties
Up to USD 2,663 per violation and USD 7,988 per intentional violation or one involving a consumer the business knows is under 16 (adjusted for inflation in January 2025). Consumers can also sue over some data breaches, for USD 107 to USD 799 each per incident or their actual damages if higher.
Who it affects
For-profit businesses that do business in California and meet at least one of these tests: annual gross revenue over USD 26,625,000 in the previous calendar year; buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or earning 50% or more of revenue from selling or sharing it.

What the CCPA requires

  • Show a “Do Not Sell or Share My Personal Information” link, or an allowed alternative, in the header or footer of your homepage if you sell or share personal information.
  • Treat a browser opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of sale and sharing, and show on your site whether you have processed it.
  • Disclose the categories of personal information collected and the purposes for collection.
  • Respond to consumer requests to know, delete, or correct their data within 45 days.
  • Avoid discriminating against users who exercise their privacy rights.

Your site’s footer

An example

  • Privacy policy
  • Terms
  • Do Not Sell or Share My Personal Information

What the banner does here

No blocking wall. A “Do Not Sell or Share My Personal Information” link on every page, and a preference centre where the visitor can opt out.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Opting out later. The opt-out link and preference centre are always available, so visitors can opt out or change an earlier choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • CPRA

    Opt-out

    California Privacy Rights Act

    California, USA In force since January 2023

  • CPA

    Opt-out

    Colorado Privacy Act

    Colorado, USA In force since July 2023

  • CTDPA

    Opt-out

    Connecticut Data Privacy Act

    Connecticut, USA In force since July 2023, with major amendments from July 2026

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price