California does not have a dedicated cookie law. Instead, cookies and other online tracking fall under the California Consumer Privacy Act, as expanded by the California Privacy Rights Act, which regulates how businesses collect and use personal information. The model is opt-out, not opt-in: a website can start collecting data through cookies without asking first, but it has to disclose what it collects, let California residents stop the sale or sharing of that data, and honor that choice promptly.1State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Why You Don’t See a Mandatory Consent Banner
European sites greet you with an accept-or-reject banner because the EU’s General Data Protection Regulation requires opt-in consent before tracking begins. California took the opposite route. Under the CCPA and CPRA, a business can begin collecting personal information through cookies immediately, provided it tells you what it is collecting and gives you a working way to opt out of sale or sharing.
What California actually requires is a conspicuous link on the homepage labeled “Do Not Sell or Share My Personal Information” and, when sensitive data is involved, a second link labeled “Limit the Use of My Sensitive Personal Information.” A combined “Your Privacy Choices” link can cover both. Many businesses still deploy cookie banners because they also serve European visitors, or because a banner is a convenient place to surface the opt-out. The banner itself is not mandated by California law.
Which Businesses Are Covered
The rules apply to for-profit entities doing business in California that meet at least one of three thresholds. The revenue threshold is adjusted annually for inflation and currently sits at annual gross revenue above $26,625,000 in the preceding calendar year.2California Privacy Protection Agency. Updated Monetary Thresholds in CCPA A business is also covered if it buys, sells, or shares the personal information of 100,000 or more California consumers or households each year, or if it derives 50 percent or more of its annual revenue from selling or sharing personal data.3California Legislative Information. California Civil Code 1798.140 – Definitions
Physical location of the company doesn’t matter. A retailer whose loyalty program tracks purchases across 100,000 California households is covered even if it never sells the data.
What a Website Must Tell You Before Collecting Data
The core disclosure is the Notice at Collection. It has to reach the consumer at or before the moment the site starts gathering personal information. If it doesn’t, the business cannot legally collect the data.4Cornell Law Institute. 11 CCR 7012 – Notice at Collection of Personal Information
The notice must identify the categories of personal information being collected, such as identifiers, browsing history, or commercial activity, and describe each in a way that makes clear what is actually being tracked. It has to state the purpose of each category and explain how the information will be used. It must disclose whether any category is sold or shared with third parties, and if so, link to the opt-out page. It also has to state how long the business plans to keep each category, or, if a fixed timeframe isn’t possible, describe the criteria used to decide when data gets deleted.5California Privacy Protection Agency. What General Notices Are Required By The CCPA The business’s full privacy policy must be updated at least once every twelve months.
Your Rights Over Cookie-Collected Data
California residents have six rights over personal information collected through cookies and other tracking methods.1State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
- The right to know what personal information a business has collected about you, where it came from, why it was collected, and who it was shared with.
- The right to delete personal information a business collected from you. The business must also instruct its service providers to delete it, though exceptions apply, such as when the data is needed to complete a transaction or to comply with a legal obligation.
- The right to correct inaccurate information a business holds about you.
- The right to opt out of the sale of your personal information or its sharing for cross-context behavioral advertising, meaning ads targeted at you based on your activity across multiple sites.
- The right to limit the use of sensitive personal information to what’s necessary to provide the service you asked for. Sensitive data includes Social Security numbers, financial account details, precise geolocation, biometric data, and health information.
- The right to equal service and pricing. A business cannot charge you more, give you worse service, or deny you service because you exercised any of these rights.
You cannot be required to create an account just to exercise these rights. A business must verify your identity before releasing or deleting data, but the verification process has to stay simple enough that it doesn’t discourage you from making the request.
How Opt-Out Actually Works
The “Do Not Sell or Share My Personal Information” link on the homepage should take you to a page where you can execute the choice without unnecessary steps. Beyond that manual route, businesses must recognize and honor Global Privacy Control signals sent by your browser. GPC is a technical standard that transmits a universal opt-out preference automatically, so you don’t have to visit each site individually.6Global Privacy Control. Global Privacy Control Under California law, a GPC signal counts as a legally valid opt-out request.
Once a business receives an opt-out request through either method, it has at most 15 business days to stop selling or sharing the information. If it transfers data in the gap between receipt and processing, it must notify downstream recipients and tell them to stop as well.
The Rule Flips for Minors
Adults have to opt out. For anyone under 16, the default is reversed: a business with actual knowledge that a consumer is under 16 cannot sell or share that person’s data unless it first gets affirmative opt-in consent. Teenagers aged 13 to 15 can provide that consent themselves. For children under 13, a parent or guardian must authorize it.7California Legislative Information. California Civil Code 1798.120 – Consumers Right to Opt-Out of Sale or Sharing A business that willfully ignores a consumer’s age is treated as though it knew, so avoiding age questions is not a defense.
Dark Patterns and Banner Design
California law defines a “dark pattern” as a user interface designed or manipulated in a way that undermines a user’s ability to make genuine choices about privacy. Consent obtained through a dark pattern doesn’t count as consent at all.3California Legislative Information. California Civil Code 1798.140 – Definitions
The California Privacy Protection Agency has told businesses to offer “symmetrical choices.” The button to decline cookies or opt out should be as prominent and easy to find as the button to accept.8California Privacy Protection Agency. CPPA Enforcement Advisory Stresses the Importance of Avoiding Dark Patterns Oversized, brightly colored “Accept” buttons paired with a tiny “Decline” link, or decline options hidden behind a second settings page, fall squarely within what the agency is targeting.
Pre-checked boxes assuming consent, extra clicks required to reject tracking, and decline wording designed to guilt users into agreeing are all at risk of being classified as dark patterns. Businesses using third-party consent management platforms remain responsible for the design of those interfaces. Hovering over, muting, pausing, or closing a cookie banner does not constitute consent, so a site that treats a dismissed banner as acceptance is in violation.
Fines and Lawsuits for Violations
The California Privacy Protection Agency and the state Attorney General share enforcement authority. The original CCPA gave businesses a 30-day window to fix a violation before penalties could attach. The CPRA eliminated that mandatory cure period on January 1, 2023, so regulators can now act immediately.
Fine amounts are adjusted annually for inflation. The current cap is $2,663 per unintentional violation and $7,988 per intentional violation or any violation involving the data of a consumer the business knew was under 16.9California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties Because penalties run per violation, a single practice affecting many consumers can generate significant aggregate liability.
Consumers have a limited private right of action when a data breach exposes unencrypted personal information because a business failed to maintain reasonable security. Before suing for statutory damages, you must give the business 30 days’ written notice identifying the violation. If the business genuinely fixes the problem and provides written assurance it won’t recur, the suit for statutory damages is blocked, though improving security after a breach does not count as a cure for that specific incident. If the business doesn’t fix the problem, statutory damages run from $100 to $750 per consumer per incident, or actual damages, whichever is greater.10California Legislative Information. California Civil Code 1798.150 – Personal Information Security Breaches Courts weigh the seriousness of the misconduct, the number of violations, and whether the business acted willfully when setting the amount.