CCPA / CPRA for U.S. websites: the obligations beyond the privacy policy

A practical walkthrough of the four CCPA / CPRA UI obligations the California Privacy Protection Agency actively scans for — Do-Not-Sell links, sensitive-PI limits, GPC honoring, and notice at collection.

If you serve any California residents — and almost every U.S. website does — your obligations under the California Consumer Privacy Act (as amended by the California Privacy Rights Act) extend beyond having a privacy policy. The CPRA created the California Privacy Protection Agency (CPPA), the first U.S. data-protection regulator with dedicated enforcement staff, and they are actively scanning sites for the specific UI obligations below.

Who is in scope

CCPA / CPRA applies to for-profit businesses that collect personal information of California residents AND meet at least one of:

• Annual gross revenue over $25 million (worldwide, not California-only).
• Annually buy, sell, or share personal information of 100,000 or more California residents or households.
• Derive 50% or more of annual revenue from selling or sharing personal information.

Sub-thresholds are common — many B2B SaaS companies hit the 100,000 mark through ordinary marketing analytics. If you have any meaningful traffic from California, assume you're in scope until proven otherwise.

The four website obligations the regulator looks for

1. A clear “Do Not Sell or Share My Personal Information” link

Required on the homepage and on every page that collects personal information from California residents. Must use that exact phrasing or the agency-approved shorthand “Your Privacy Choices” combined with the official CCPA opt-out icon. Footer placement is conventional. It must lead to a functional opt-out mechanism — a form, a toggle, or a clearly-labeled contact path — not a paragraph telling the user to email you.

2. A “Limit the Use of My Sensitive Personal Information” link

Required if you use sensitive PI for any purpose other than what's necessary to provide your goods or services. Sensitive PI includes precise geolocation, race, religion, sexual orientation, health information, account credentials, and financial-account information. The link mirrors the do-not-sell pattern.

3. Honor Global Privacy Control (GPC)

Recent CPPA enforcement has clarified that the GPC browser signal is a legally-valid opt-out — when a user's browser sends the GPC header or the JavaScript property, you must treat it as the consumer exercising their CCPA right to opt out. You cannot require a separate click on your do-not-sell link if GPC is already on. Sephora paid $1.2M in 2022 specifically for failing to honor GPC.

4. Notice at collection

At or before the point of collection, tell the user what categories of PI you collect and the purposes. Typically delivered through a layered notice — a short banner or text snippet near the form with a link to the full privacy policy. Pre-checked “I accept” boxes are explicitly not valid consent.

What enforcement actually looks like

Two distinct enforcement vectors:

• CPPA administrative actions. The agency runs automated sweeps of high-traffic sites. Initial communications are typically a notice of violation with a 30-day cure period (the cure period sunset on most violations on January 1, 2023 — so a notice today is more likely to come with a proposed fine). Public actions to date have ranged from $50k to $1.2M with substantial injunctive relief.
• Private right of action. Limited to data-breach scenarios involving unencrypted or unredacted PI. Statutory damages are $100 to $750 per consumer per incident. Class actions can scale quickly.

Practical compliance checklist for this quarter

1. Add a footer link reading “Your Privacy Choices” (with the CCPA icon) on every page. Have it open a privacy-controls page with clearly-named toggles for selling, sharing, sensitive-PI use, and targeted advertising.
2. Implement server-side detection of the GPC header / JS property. When present, set the user's opt-out flags automatically and persist across sessions if you have a user account.
3. Update your cookie banner to surface a working reject path that respects GPC. “Accept all” with no reject option is non-compliant.
4. Refresh your privacy policy to enumerate the categories of PI collected per the CCPA category list. Vague language (“we collect usage data”) doesn't satisfy the obligation.
5. Re-run a Plumb scan and confirm the Privacy and Cookie-Consent sections report all checks passed.

The state-law sprawl

California is the loudest but no longer alone. As of 2026, comprehensive consumer-privacy laws are in force in Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and an expanding list. Each has its own obligations, but the practical UI patterns converge: a privacy-controls page, a do-not-sell-or-share link, GPC honoring, and a refreshed privacy policy. If you build for California you are most of the way to all of them.

This article is not legal advice. Privacy obligations depend on your specific data flows and consumer base. Consult qualified counsel for your circumstances.