Which Cookies Need Consent Under the CCPA

How the CCPA Decides Which Cookies Need Consent

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), sets no general opt-in requirement before a site sets cookies. The CCPA gives consumers in California the right to opt out of the sale and the sharing of their personal information instead, under section 1798.120 of the California Civil Code.

The CCPA applies to a for-profit business that meets 1 of 3 tests. The first test is annual gross revenue above the threshold the California Privacy Protection Agency adjusts for inflation. The second test is the purchase, sale, or sharing of the personal information of 100,000 or more consumers or households. The third test is half or more of annual revenue from selling or sharing personal information. Check the current revenue threshold on the website of the California Privacy Protection Agency.

Which Cookies Count as Sale or Sharing Under the CCPA

The CCPA calls a disclosure of personal information to a third party for cross-context behavioral advertising "sharing", whether or not money changes hands. Advertising pixels and social media pixels on a site usually send data for that purpose, so the data their cookies collect counts as sharing.

A vendor that processes the data only for its service to your site, under a contract with the terms the CCPA lists, acts as a service provider or a contractor. The disclosure to that vendor counts as neither sale nor sharing. Analytics cookies stay outside the opt-out right while the vendor keeps that role.

What the CCPA Requires for Advertising Cookies

The CCPA requires a business that sells or shares personal information to offer an opt-out and to honor it. Offer a "Do Not Sell or Share My Personal Information" link, or the alternative opt-out link the CCPA regulations allow, and treat a Global Privacy Control (GPC) signal from the browser as a valid opt-out request.

Sharing the personal information of a consumer under 16 needs opt-in consent instead of an opt-out. The consumer gives that consent from 13 to 15 years, and a parent gives it for a consumer under 13. The California Attorney General settled with Sephora in August 2022 for $1.2 million, partly for ignoring GPC signals, the first public settlement under the CCPA.

Cookie Categories Under the CCPA

The table gives the rule of the CCPA for each cookie category of the Cookie Consent cookie database. The page of each cookie adds the conditions that change the answer for a single tool.

The table describes what the CCPA requires and is not legal advice. Whether the CCPA applies to your site depends on where your visitors are, where your business is based, and how you set up each tool.

Cookies in the Database and Their Rule Under the CCPA

The database gives the rule of the CCPA for 19 cookies. Open a cookie to read the reason and the setup that changes the answer.