California has a requirement that no other US state privacy law has: the "Do Not Sell or Share My Personal Information" link visibly displayed on the homepage.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CCPA and cookies.

That link exists because of cookies.

When a site installs an advertising pixel, that pixel collects data about user behavior and sends it to the advertising platform. This constitutes "sharing" of data for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). And sharing requires an opt-out.

This article focuses exclusively on what the CCPA/CPRA requires from a Cookies Policy: what must be in the document, how consent and opt-out must work, and what the law's specific requirements mean for each tracker on your site.

The cookie banner is the visual interface. It is what the visitor sees when they access the site and where they make choices about what they accept.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, how long it is retained, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the consent notice itself.

The distinction created by the CPRA is fundamental to understanding what the CCPA requires in the context of cookies.

Sale (§ 1798.140(ad)): transfer of data for monetary or other valuable consideration to third parties.

Sharing (§ 1798.140(ah)): transfer of data to third parties for cross-context behavioral advertising, with or without monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): ads targeted based on personal information obtained from consumer activity across different businesses, distinctly branded websites, applications, or services.

In practice: if your site has a pixel that sends user behavior data to an advertising platform to display ads on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly. And sharing requires:

The "Do Not Sell or Share My Personal Information" link on the homepage.

Clear and conspicuous disclosure in the privacy notice.

Honoring the opt-out when exercised.

§ 1798.100(a)(1) requires the business to inform consumers, at or before the point of collection, of the categories of personal information to be collected and the purposes for which they are collected or used, and whether that information is sold or shared.

For cookies, each tracker category needs a specific purpose description. "Cookies to improve your experience" is not a purpose.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify opportunities for content improvement. This data is not sold or shared with third parties for advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for cross-context behavioral advertising. Data is shared with partners such as Meta Ads and Google Ads. Consumers can opt out via the 'Do Not Sell or Share My Personal Information' link."

The Policy must list the tracker categories:

Necessary cookies: essential for basic functionality. Do not constitute sale or sharing and do not require the opt-out link. But must be documented.

Analytics cookies: depends on configuration. If data stays within company systems and is not sent to third parties for targeting, they generally do not constitute "sale" or "sharing." But most major analytics platform cookies send data to the provider, which may constitute a business purpose disclosure.

Advertising and retargeting cookies: almost always constitute "sharing" under the CCPA/CPRA. Meta Pixel, Google Ads, TikTok Pixel, programmatic DSP pixels: all send data to platforms that use that data to display behavioral ads to the user on other sites.

Functional cookies: remember user preferences. Generally do not constitute sale or sharing if the data stays internal.

Third-party cookies: fired by external services integrated into the site. Correct tag categorization is what makes it possible to document each one accurately.

The Policy must identify the categories of third parties receiving data via cookies.

§ 1798.115(a) requires the business to disclose, upon consumer request, the categories of third parties to whom it sold or shared data, by category of personal information.

For cookies, this means documenting that, for example: browsing behavior data was shared with digital advertising platforms; session data was disclosed to analytics service providers; user identifiers were shared with programmatic advertising networks.

§ 1798.100(a)(3) requires the business to disclose the length of time it intends to retain each category of data, or the criteria used to determine that period.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in company systems.

Whether and when data is deleted.

§ 1798.135(b) allows the business to comply with opt-out requirements by honoring the opt-out preference signal sent by platforms, technologies, or mechanisms with the consumer's consent.

The Global Privacy Control (GPC) is the best-known mechanism implementing this functionality. When the user activates the GPC in their browser, the site must interpret this signal as an opt-out of sale and sharing.

The Cookies Policy must state whether the site respects the GPC and how this mechanism works.

A well-configured consent management platform detects and honors the GPC automatically.

Precise geolocation data (radius of 1,850 feet or less) is sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)(1)(C)).

If the site collects precise geolocation data via cookies or location scripts for purposes beyond what is necessary to provide the requested product or service, the consumer has the right to limit this use via the "Limit the Use of My Sensitive Personal Information" link (§ 1798.121).

The Cookies Policy must identify whether precise geolocation data is collected, what it is used for, and how the consumer can limit its use.

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization.

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: parental or legal guardian authorization.

If the site may have users under 16, the Cookies Policy must describe how data from those users is treated differently, including how advertising cookies are blocked without adequate authorization.

§ 1798.130(a)(5) requires updating the privacy notice at least once every 12 months. For the Cookies Policy, this means a mandatory annual review.

Situations requiring immediate update:

Adding a new advertising pixel.

A new analytics tool that sends data to third parties.

A new chat or support plugin.

A new CRM or email marketing platform integration.

Any new partner receiving behavioral data.

Continuous data mapping is what keeps the cookie inventory synchronized with the document.

§ 1798.190 provides that transactions or series of steps intentionally created to avoid the definition of "sale" or "sharing," including eliminating monetary consideration to circumvent the law, will be disregarded.

This means that structuring data exchange agreements without monetary consideration to avoid the opt-out is not a valid strategy. The CCPA/CPRA looks at the substance of the transaction, not just its form.

The California Privacy Protection Agency (CPPA) can impose administrative fines of up to US$ 2,500 per violation and up to US$ 7,500 for intentional violations or violations involving minors. The Attorney General can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act.

Additionally, § 1798.150 grants consumers the private right of action for security breaches: US$ 100 to US$ 750 per consumer per incident.

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real opt-out options, honors the GPC automatically, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.

Visible link in the site footer and within the cookie banner.

Listing of cookie categories with a description of what each one does.

Specific purpose for each category, including a statement of whether data is sold or shared.

Identification of cookies that constitute "sale" or "sharing" under the CCPA/CPRA definition.

Categories of third parties that receive data via cookies.

"Do Not Sell or Share My Personal Information" link on the homepage when there is sale or sharing.

"Limit the Use of My Sensitive Personal Information" link when precise geolocation data is collected for purposes beyond the necessary.

Global Privacy Control (GPC): statement that the site honors the signal when sent by the user.

Retention period for each cookie category.

Protection for minors aged 13 to 15 and under 13.

Annual update of the document.

Accessible language, without legal jargon.

No dark patterns in opt-out mechanisms.

1. Does an advertising pixel always constitute "sharing" under the CCPA/CPRA?
Almost always, yes. The CCPA/CPRA defines "sharing" as the transfer of data for cross-context behavioral advertising, with or without monetary consideration. A pixel that sends user behavior data from your site to a platform that uses that data to display ads to the same user on other sites constitutes sharing. The site needs the "Do Not Sell or Share My Personal Information" link and must honor the opt-out.

2. Does Google Analytics constitute "sharing" under the CCPA/CPRA?
It depends on the configuration. Google Analytics in its default configuration sends data to Google, which has its own data use policies. If that data is used by Google for ad targeting on other sites (which may occur depending on settings), there is a risk of constituting sharing. The safest approach is to use GA with enhanced privacy settings and review the data processing terms with Google.

3. What is the Global Privacy Control (GPC) and must the site respect it?
The GPC is a browser signal that the user can activate to indicate their opt-out preference for sale and sharing of data. § 1798.135(b) allows the business to comply with opt-out requirements by honoring the GPC, instead of maintaining the "Do Not Sell or Share" and "Limit Sensitive PI" links on the site. Both approaches are valid: visible links on the site, or honoring the GPC. The business may choose one of the two strategies.

4. Do analytics cookies need the "Do Not Sell or Share" link under the CCPA/CPRA?
It depends on how the data is used. If analytics data stays only within company systems and is not sent to third parties for targeting purposes, it generally does not constitute "sale" or "sharing." But if the analytics tool is from a major provider that may use the data for other purposes including targeting, there is risk. Reviewing the tool's data processing terms is essential.

5. What happens if the consumer opts out and the site continues sharing data?
Continued sale or sharing after opt-out is a direct violation of § 1798.120(d). The CPPA may investigate and impose fines of up to US$ 2,500 per violation or US$ 7,500 for intentional violations. Additionally, the affected consumer may have grounds for a civil lawsuit. The business must wait at least 12 months before requesting the consumer's consent to sale or sharing again.

Ready to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.