TL;DR CCPA stands for the California Consumer Privacy Act, a state law signed in 2018 and in force since January 1, 2020. It gives California residents the right to know, delete and correct the personal information a business holds about them, and to opt out of its sale or sharing. The CPRA amended it in 2023, and the CPPA enforces it. For a website, the part that breaks most often is the opt-out: a pixel that keeps sending data after the visitor said no.
CCPA is one of those acronyms that shows up in a privacy policy footer, a cookie banner and a legal ticket in the same week. It stands for the California Consumer Privacy Act. What it asks of your site is less obvious than its name, so this post covers what each letter means, who has to comply, and where it touches your tags.
What CCPA stands for
California Consumer Privacy Act. It is a California state law, signed on June 28, 2018 as Assembly Bill 375 and in force since January 1, 2020. The California Attorney General describes it as a law that "gives consumers more control over the personal information that businesses collect about them" (CCPA, State of California Department of Justice).
Each word narrows what it covers:
- California: it protects California residents. The business can be anywhere.
- Consumer: any natural person who lives in California, even when temporarily outside the state. Not only your customers: a visitor who never buys is a consumer too.
- Privacy: of personal information, which is broader than names and emails (more on that below).
- Act: a statute in the California Civil Code, with regulations that spell out how to apply it.
CCPA, CPRA and CPPA
Three acronyms, one law. They get mixed up because they differ by a single letter.
| Acronym | Stands for | What it is |
|---|---|---|
| CCPA | California Consumer Privacy Act | The law, from 2018 |
| CPRA | California Privacy Rights Act | Proposition 24, approved in November 2020, which amended the CCPA from January 1, 2023 |
| CPPA | California Privacy Protection Agency | The agency the CPRA created to enforce the law, alongside the Attorney General |
When someone says "CPRA compliance" today, they mean compliance with the CCPA as the CPRA amended it. There is one law to follow. The agency behind it has its own explainer.
Who has to comply
The CCPA applies to for-profit businesses that do business in California and meet any one of three thresholds (Attorney General FAQ):
- Annual gross revenue above $25 million, adjusted for inflation: $26,625,000 since January 1, 2025 (CPPA announcement).
- Buying, selling or sharing the personal information of 100,000 or more California residents or households.
- Deriving 50% or more of annual revenue from selling or sharing California residents' personal information.
The second threshold is the one marketing teams underestimate. A site with ad pixels that reaches 100,000 California residents a year can meet it without selling anything in the everyday sense of the word. Nonprofits and government agencies are generally out of scope.
The rights it gives
California residents can ask a business covered by the law to:
- Know what personal information it collects about them, and how it is used and shared.
- Delete the personal information collected from them, with some exceptions.
- Correct inaccurate personal information (since 2023).
- Opt out of the sale or sharing of their personal information, including through the Global Privacy Control (GPC), a signal the browser sends.
- Limit the use and disclosure of sensitive personal information (since 2023).
- Not be discriminated against for using any of these rights.
The first three are handled by a request process. The opt-out is different: it has to work on every page, for every visitor, in real time. That makes it a tracking problem as much as a legal one.
Personal information is more than an email
Under the CCPA, personal information is anything that "identifies, relates to, or could reasonably be linked with" a person or a household. The Attorney General's examples include internet browsing history, geolocation data and inferences used to build a profile of someone's preferences (CCPA FAQ).
That covers most of what analytics and advertising tags send: a page URL, a click ID, a device identifier, a purchase. And "sharing" has a precise meaning: sharing for cross-context behavioral advertising, which the Attorney General defines as targeting ads based on someone's activity across many websites. That is what an ad pixel does.
What the CCPA means for your tracking
For a website, the CCPA turns into three things to get right:
- A "Do Not Sell or Share My Personal Information" link, which businesses that sell or share must show. The CCPA cookie banner post covers the user experience.
- The GPC signal honored as an opt-out, without the visitor having to click anything.
- Tags that stop after the opt-out. This is where it fails in practice. A release moves a tag out of its consent trigger, a new campaign adds a pixel that never checks the opt-out state, a server-side container forwards a conversion the browser already blocked.
None of these failures shows up in a dashboard. The banner still appears, the link still works, and the advertising pixel keeps sending data after the visitor said no. You find out when someone audits the requests.
That is what Trackingplan watches on web and server-side traffic. It reads the consent state on every hit and flags any tag that fires after a rejection, keeps sending after consent is withdrawn, or fires before the visitor has chosen. Each finding comes with the hits, the destination and the cookies involved, which is the evidence a privacy lead needs. In the product's words: "GDPR, ePrivacy and CCPA-ready evidence trails." See how it works for privacy and legal teams.
Fines and enforcement
Since January 1, 2025, administrative fines go up to $2,663 per violation and $7,988 per intentional violation, or when the violation involves the data of consumers known to be under 16 (CPPA announcement). The Attorney General and the CPPA enforce the law.
Individuals cannot sue for most violations. The exception is a data breach caused by a failure to keep reasonable security, with statutory damages now between $107 and $799 per consumer per incident.
Per-violation fines add up on a site that sends the same request on every page view. That is why the opt-out matters more than its size on the page suggests. For the full list of obligations, read CCPA compliance requirements.
Frequently asked questions
What does CCPA stand for?
CCPA stands for the California Consumer Privacy Act, a California state law from 2018 that gives California residents rights over the personal information businesses collect about them: to know, to delete, to correct, to opt out of its sale or sharing, to limit the use of sensitive information, and not to be discriminated against for using those rights.
What is the difference between the CCPA and the CPRA?
The CPRA, the California Privacy Rights Act, is not a separate law to comply with. Approved by voters as Proposition 24 in November 2020, it amended the CCPA from January 1, 2023: it added the rights to correct and to limit sensitive personal information, extended the opt-out to sharing for cross-context behavioral advertising, and created the California Privacy Protection Agency (CPPA) to enforce the law.
Does the CCPA apply to companies outside California?
Yes. It applies to for-profit businesses that do business in California and meet one of three thresholds: annual gross revenue above the adjusted amount ($26,625,000 since January 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving half or more of their annual revenue from selling or sharing it. Where the company is based does not matter.
Is the CCPA the same as the GDPR?
No. The GDPR asks for a legal basis, often consent, before personal data is processed. The CCPA lets businesses collect personal information with notice, and gives residents the right to opt out of its sale or sharing. A site that serves both the EU and California needs both: consent before tracking for EU visitors, and a working opt-out, including the Global Privacy Control signal, for California residents.