CCPA cookie banner: requirements for 2026

The California Consumer Privacy Act (CCPA), as amended by the CPRA, does not require an opt-in cookie banner like the EU's. It requires covered businesses to tell visitors what their cookies and pixels collect, to let them opt out of the "sale" or "sharing" of their data through a "Do Not Sell or Share" link, to treat the Global Privacy Control browser signal as an opt-out, and to make opting out as easy as opting in. Most advertising cookies count as "sharing", so a site with ad pixels usually needs a working opt-out. This guide explains who is covered, what a CCPA-ready cookie setup looks like as of September 2026, and how to test it. It is part of our guide to cookie consent and what the law requires.

Watch out

This guide explains the rules in plain language and names its sources, current as of September 2026. It is not legal advice. Whether the CCPA applies to you, and how, depends on your business and data; the California Privacy Protection Agency (CPPA) keeps updating its regulations. For a decision with legal consequences, ask a qualified lawyer.

Quick answer

Who: for-profit businesses that do business in California and have annual gross revenue over $26,625,000 (the 2025 inflation-adjusted figure), or buy, sell or share the personal information of 100,000 or more California consumers or households a year, or earn half or more of their revenue from selling or sharing it.
No opt-in needed for adult visitors' cookies. The model is notice plus opt-out. Opt-in applies to consumers you know are under 16.
Ad pixels usually count as "sharing" (cross-context behavioural advertising), so visitors must be able to opt out of them.
Required pieces: a notice at collection, a "Do Not Sell or Share My Personal Information" link (or the "Your Privacy Choices" alternative), and a privacy policy.
Global Privacy Control is an opt-out request under the CCPA regulations, and since 1 January 2026 your site must show whether it processed it.
No dark patterns: a banner with a one-click "Accept all" but a multi-step opt-out is not symmetrical, and the CPPA has fined companies for exactly that.
Test it with a GPC-enabled browser and the free cookie scanner, and check that ad pixels stop after an opt-out.

Not as such. Nothing in the CCPA or its regulations says "show a cookie banner". It requires four things that a banner is often the most convenient way to deliver:

A notice at collection (Cal. Civ. Code § 1798.100 and CCPA regulations § 7012): at or before the point where you collect personal information, tell consumers the categories you collect, the purposes, whether it is sold or shared, and how long you keep it, with a link to your privacy policy. Collection by cookies and pixels starts on page load, so the notice has to be visible then, typically as a banner or a footer link labelled "Notice at Collection".
A way to opt out of sale and sharing (§ 1798.120 and § 1798.135): a clear "Do Not Sell or Share My Personal Information" link, or an alternative opt-out link, on every page where you collect personal information.
Honouring opt-out preference signals such as Global Privacy Control (regulations § 7025).
Choice architecture without dark patterns (regulations § 7004).

So a US site does not need to block cookies before a click the way an EU site must, but it does need a working opt-out that really stops the tracking.

The CPRA added "sharing" to close a gap. Under § 1798.140:

Sale means making personal information available to a third party for money or "other valuable consideration".
Sharing means disclosing personal information to a third party for cross-context behavioural advertising: ads targeted on the basis of activity across other businesses' sites and apps.

Cookie IDs, device identifiers and browsing activity are personal information under the CCPA's definition. So when a Meta Pixel, TikTok Pixel, Google Ads remarketing tag or ad network tag on your site sends visitor data to that company for ad targeting, you are very likely "sharing". California's Attorney General reached that conclusion in the 2022 Sephora settlement ($1.2 million), finding that third-party trackers exchanged for analytics and advertising benefits were a sale.

Analytics that a vendor processes only on your behalf, under a contract that meets the CCPA's service-provider requirements, is generally not a sale or share. The contract matters: a vendor that may use your visitors' data for its own purposes is a third party, not a service provider.

1. The opt-out link

Put one of these in the footer of every page, and make it work immediately:

"Do Not Sell or Share My Personal Information", and, if you use sensitive personal information for purposes beyond those the regulations allow, "Limit the Use of My Sensitive Personal Information"; or
one alternative link, "Your Privacy Choices" or "Your California Privacy Choices", with the opt-out icon the regulations provide (§ 7015), that leads to a page where the visitor can do both.

The link should lead to a choice that takes effect, usually a toggle in your consent platform, not to a form asking for name, address and phone number. Opting out of sale or sharing does not require identity verification, and the CPPA's 2025 action against the retailer Todd Snyder ($345,178) was partly about asking for too much information to opt out.

2. Global Privacy Control

Global Privacy Control (GPC) is a browser signal sent as an HTTP header, Sec-GPC: 1, and exposed to scripts as navigator.globalPrivacyControl. Firefox (a setting in Privacy & Security), Brave and DuckDuckGo's browser can send it. Under § 7025 of the CCPA regulations, a business that sells or shares must treat it as a valid request to opt out, for that browser and any consumer profile associated with it.

Two things changed recently:

Since 1 January 2026, the amended § 7025(c)(6) requires you to display whether you processed the signal as a valid opt-out, for example with a message such as "Opt-Out Request Honored" on the site or in your privacy choices panel.
From 1 January 2027, California's Opt Me Out Act (AB 566, signed October 2025) requires web browsers to offer a setting that sends an opt-out preference signal. Expect far more visitors to arrive with it switched on.

In practice, your consent platform should read navigator.globalPrivacyControl on the first page load, switch off sale and sharing categories for that visitor before any ad pixel fires, and show the confirmation.

Section 7004 of the regulations requires symmetry in choice: the path to a more privacy-protective option must not be longer or harder than the path to a less protective one. The regulations' own example: a banner offering only "Accept All" and "More Information" (or "Preferences") is not symmetrical when accepting takes one click and opting out takes several.

The CPPA applied this in March 2025, fining American Honda $632,500 partly because its cookie tool let visitors accept all cookies in one step but made them take extra steps to opt out. If your banner shows "Accept all", it should show "Reject all" or "Do not sell or share" with the same prominence. That is also what EU regulators require, as our guide to a cookie banner that passes explains.

4. Make the opt-out actually stop tracking

An opt-out that changes a setting but leaves the pixels firing is the most common CCPA cookie failure, and it is what enforcement has focused on:

Todd Snyder (CPPA, May 2025): a misconfigured consent platform meant opt-out requests were not processed for 40 days.
Healthline (Attorney General, July 2025, $1.55 million): data kept flowing to advertising partners after visitors had opted out.
Tractor Supply (CPPA, September 2025, $1.35 million): among other failures, the site did not honour GPC signals until July 2024, and its opt-out webform did not stop sharing through third-party tracking technologies. The order requires the company to scan its sites for tracking regularly.

After an opt-out, the Meta Pixel, TikTok Pixel, ad network tags and Google Ads remarketing should stop firing, or be switched to a restricted mode such as Meta's Limited Data Use or Google's restricted data processing. Server-side conversion APIs must respect the same choice, because the browser never sees them.

5. Privacy policy and notice

Your privacy policy must list the categories of personal information collected in the last 12 months (identifiers such as cookie IDs, internet activity, geolocation), the categories of third parties you share with, and how to opt out, including how you respond to GPC. California's older CalOPPA also requires the policy to say how you respond to Do Not Track signals and whether third parties track visitors across sites. Our guide to what a cookie policy must list covers the cookie table.

6. Consumers under 16

If you have actual knowledge that a consumer is under 16, you may not sell or share their data without opt-in consent: from the consumer if they are 13 to 15, from a parent if under 13. Sites aimed at children or teenagers should not load cross-context advertising pixels by default at all.

Beyond California: other US state laws

As of September 2026, about 20 states have comprehensive privacy laws in force or passed, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. They share California's opt-out model for targeted advertising and the sale of personal data, with differences in thresholds and definitions.

Twelve states, California among them, require businesses to honour a universal opt-out signal such as GPC: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. In September 2025, the CPPA and the attorneys general of California, Colorado and Connecticut announced a joint investigative sweep of businesses that ignore GPC. Several states also require opt-in consent before processing sensitive data, which can include precise geolocation collected by scripts.

The practical approach for a national site: honour GPC for every US visitor, offer the same opt-out link everywhere, and treat sensitive data with opt-in.

	EU (GDPR and ePrivacy)	California (CCPA/CPRA)
Model	Opt-in before non-essential cookies	Notice plus opt-out of sale and sharing
Before the first click	Only strictly necessary cookies	Cookies may load, notice must be visible
Key button	"Reject all" equal to "Accept all"	"Do Not Sell or Share" link; symmetrical choices
Browser signal	Not binding as of September 2026	GPC is a valid opt-out; status must be shown
Minors	Parental consent rules vary by country	Opt-in under 16
Who enforces	National data protection authorities	CPPA and the California Attorney General

A site with both EU and US visitors can use one consent platform with geolocation: opt-in for EU, UK and Swiss visitors, opt-out with GPC for US visitors. Geolocation is never perfect, so many sites apply the stricter EU behaviour everywhere, which also satisfies California.

Scan the first visit. The free cookie scanner loads your page in a fresh browser, lists every cookie and tracker before and after it clicks Accept, and names the ad pixels it recognises. For a US-only setup the pre-consent list is not a violation in itself, but it shows exactly which pixels your opt-out must stop.

The scanner visits from Frankfurt, so a geolocated banner shows its EU version, and it does not send a GPC signal. Test the US behaviour with the next steps.

Test GPC. Open the site in a browser with GPC switched on, from the US or through a US connection. In DevTools, the Network panel should show no requests to ad pixels, navigator.globalPrivacyControl should be true in the console, and the site should show that the opt-out was honoured.
Test the link. Without GPC, click "Do Not Sell or Share", opt out, reload, and watch the Network panel: the same ad requests should be gone, and should stay gone on the next visit.
Count the steps. Opting out should take no more clicks than accepting.
Re-test after every new tag. Tractor Supply's order requires quarterly scans; monthly is a sensible habit for any site with ad pixels.

Common mistakes

A "Do Not Sell" link that opens an email form or asks for ID.
Ignoring GPC because the visitor never clicked anything.
Opt-out that only covers new cookies, while pixels already loaded keep sending data.
"Accept all" in one click, opt-out behind "Preferences".
Forgetting server-side tracking such as conversion APIs, which keep sharing after the browser opt-out.
Assuming you are too small. A busy site with ad pixels can reach the 100,000-consumer threshold without large revenue.

Questions people ask

Not an EU-style opt-in banner. The CCPA requires a notice at collection, a "Do Not Sell or Share" link or alternative opt-out link, honouring Global Privacy Control and symmetrical choices. Many businesses use a banner because it delivers the notice at the moment cookies start collecting data, but a clear footer link plus working GPC handling can meet the requirements for adult visitors.

Is Global Privacy Control legally binding in California?

Yes. The CCPA regulations require a business that sells or shares personal information to treat a GPC signal as a valid request to opt out, for that browser and any profile linked to it. Since 1 January 2026, businesses must also show whether they processed the signal. Eleven other states, including Colorado, Connecticut, Texas and Oregon, require universal opt-out signals too.

Usually, yes. The CPRA defines sharing as disclosing personal information to a third party for cross-context behavioural advertising, which is what retargeting pixels do with cookie IDs and browsing activity. Unless the vendor is contractually limited to acting as your service provider, visitors must be able to opt out, and those tags must stop or switch to a restricted mode when they do.

The California Privacy Protection Agency can impose administrative fines per violation, $2,663 or $7,988 for intentional violations or those involving minors, at the 2025 inflation-adjusted amounts, and the Attorney General can seek civil penalties. Recent cookie-related cases include Honda ($632,500), Todd Snyder ($345,178), Healthline ($1.55 million) and Tractor Supply ($1.35 million). Each tracked visitor can be a separate violation.

CCPA cookie banner: what California requires for cookies and "Do Not Sell or Share"