Tired of the [ads from that site you visited following you around](https://goadopt.io/en/blog/gdpr-cookies-explained/)?
Is your computer running slow when accessing a particular website?
Want to delete all cookies from a specific service or site?

One of the alternatives is to **delete Cookies and Cache from your browsers!**
We'll provide you with step-by-step instructions for each of these options. But before that, to make things clear:

## What is cache?

The term cache is basically the storage of frequently used data or processes, which are stored for faster future access, thus saving time and unnecessary use of hardware processing.

This functionality is widely used in various types of devices and software, such as browsers, for example. You know when you first access a website and it takes longer to load than your favorite site that you visit every day?

That's precisely the practical application of cache! Your browser has saved various information and page structures in a reserved environment so that you don't have to download them again on future visits. This makes everything faster, especially for those with weaker internet or weak signals.

## What are cookies?

In short, cookies serve the same function as cache in terms of storing information, but in different formats and processes. Many of the services we access daily use cookies for other functionalities such as remembering your browser as a returning client, keeping items you "left in the shopping cart," recording information about your browsing, etc.

In this [article](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), you can find a more in-depth explanation.

In other words, both cookies and cache store information in your computer's or mobile device's memory. As a result, they often overload the storage and slow down the system. That's why various browsers have rules to delete all cookies every three months, for example, or are starting to block third-party cookies to avoid this unnecessary accumulation.

However, sometimes the browser's cleaning cycle is not enough.
So learn from [AdOpt](https://goadopt.io/) how to delete your browser's cache and cookies:

## How to quickly delete cookies and cache?

Sometimes, when you're experiencing issues with using an online service or accessing a website, the technical team asks you to clear the browser cache.

To get rid of the data stored on your computer when you access a website, you don't need to go to the Google Chrome Preferences. Just use the shortcut below:

### On Windows
Control + Shift + Del

Command + Shift + Del

After that, simply select the items you want to delete: cache, cookies, history... and DONE!

![clear_cookies_cache_chrome.png](https://strapi.goadopt.io/uploads/clear_cookies_cache_chrome_32fa1b37f4.png)

## Delete Cookies in Chrome

If you're using Google Chrome,

1. Click on the **three dots in the upper right corner** to open a configuration menu.
2. Go to **More Tools**.
3. Then click on **Clear browsing data**. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - **Cookies and other site data - Cached images and files**.
4. **After selecting the options, click the "Clear browsing data" button.**

**Done!**

Then click on Clear browsing data. A new window, as shown in the image below, will open, and in it, you just need to choose what you want to clear: - Cookies and other site data - Cached images and files.

After selecting the options, click the "Clear browsing data" button.

Done!

By following these instructions, your computer will be lighter, and your browsing experience will improve.
**But be prepared because all saved logins and access will also be cleared, requiring you to sign in again and "prove that you are you."**

## Clearing Cookies in Internet Explorer

If your browser is **Internet Explorer**, for any version, follow the steps below:

1. Access the menu on the right **Settings** (indicated by the gear icon as shown below).
2. Click on **Security > Delete browsing history.** (A window will open, showing your browsing history).
3. By clicking the **Delete** button, you can delete all the data saved by the **Internet Explorer **browser.

### Clearing Cookies in Mozilla Firefox
For versions of the **Mozilla Firefox **browser, follow the simple cleaning process below:

1. Menu **Firefox > Preferences**.
2. Choose the **Privacy** option.
3. Select the option **Clear your recent history**: *Here, you can determine **the time period** to be deleted and the respective details to select.
4. To finish, simply click **Clear Now.**
5. **Done**! You can now continue browsing peacefully!

## Clearing Cookies in Safari
For Safari users, the process to clear cookies is also straightforward.

Click on the **Preferences** option.
Select the **Privacy** option > **Remove all website data.**
After this click, confirm your decision.

## Continue learning about cookies

To see how cookies differ from other browser storage, read the [difference between cookies, local storage and session storage](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/). If you wonder why every site asks about cookies, read [why cookie banners are everywhere](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/). And to see what happens when you answer the banner, read [how the cookie banner works](https://goadopt.io/en/blog/operation-of-cookie-banner/).


How to delete cookies and cache in Chrome and other browsers?

João Bruno Soares

Terms of use are an essential part of many websites, especially regarding [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/). Despite being frequently overlooked, Terms of Use are, quite literally, the contract established between you and the company offering that product or service in a digital manner. Therefore, not only their development but also any eventual changes require careful consideration.

This care pertains to both the situations in which such changes can or should be applied and the manner of alteration and its consequences. In the following text, you'll find an explanation of how each of these aspects works and how to ensure the validity of your terms, as well as compliance with [LGPD, GDPR, CCPA, PIPEDA, POPIA](https://goadopt.io), among others.

## What Are the Key Topics Addressed in Terms of Use?

Before delving into why and how to make changes to the Terms of Use, let's first briefly review some of the main chapters/topics typically found in any standard document.

Based on AdOpt's own [Terms of Use](https://goadopt.io/en/blog/terms-of-use-lgpd/), the text is divided as follows:

### 1. Object

### 2. Features

### 3. Contracting and Service Provision

### 4. Term

### 5. Remuneration

### 6. Service Interruption

### 7. Responsibilities

### 8. Processing of Personal Data

Here's a brief summary of what each section covers:

1. **Object**: Identification of the involved parties and detailed description of the services provided, including their characteristics and operational definitions.

2. **Features**: In the case of software like AdOpt's, this section lists the features involved and provides detailed information within the plans.

3. **Contracting and Service Provision**: Description of the processes and necessary details for service contracting.

4. **Term**: Delivery frequency and/or product/service availability after/during purchase.

5. **Remuneration**: Explanation of how payments will be made, including pricing, payment deadlines, and conditions.

6. **Service Interruption**: Explanation of situations where service interruption is prescribed, necessary, and justified, as well as the events that may lead to interruption.

7. **Responsibilities**: Clarification of the responsibilities of both parties upon accepting the terms. On one side, the provider commits to providing the service, and the customer commits to making payments and using the system/platform as necessary for service delivery.

8. **Processing of Personal Data**: Definition of the roles of [data controller vs. data processor](https://goadopt.io/en/blog/differences-data-controller-data-processor/) within the processes established by the contract. If data is collected, the legal basis used is specified, along with the responsibilities arising from the operation.

9. **General Provisions**: Declarations that position the contract geographically, establish conditions for possible updates, provide guidance in case one of the parties breaches the contract, and specify the jurisdiction.

## Why Change the Terms of Use?

Changes to these documents, although often overlooked, are necessary whenever there is a significant alteration in the content description. Aspects such as the nature of the service or product delivered by the company, conditions of public service, official data, and now, mandatory aspects under LGPD, all necessitate changes.

Both [LGPD (General Data Protection Law)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) and other applicable regulations specify aspects related to data collection, processing, and treatment that may be part of the service or product and, therefore, must be included in the terms of use.

Furthermore, changes are often required to align the content of the terms of use with the reality of the brand. After all, these terms should reflect the company's actual situation and not be a work of fiction.

Otherwise, there's a risk of non-compatibility between the website's terms of use and its reality, services, rules, and regulations that apply to it. In essence, it renders the terms useless.

Aspects of our lives are constantly changing, and this is also true when it comes to brands, how they operate, and the rules they are subject to.

Since the terms of use relate to these matters, any changes in them should also reflect on them to ensure they remain valid and relevant, fulfilling their role in relation to the brand.

## When Is It Necessary to Change the Terms of Use?

In general terms, changes should be made whenever one of these aspects is identified:

- Alteration in the site's mode of operation.
- Addition or modification of available services and products.
- Legal changes affecting the rules a site can apply, as well as the duties and rights it imposes.
- Inadequacy between the terms and the reality of the brand (such as its characteristics, offerings, and operations), or between the terms and current laws (such as LGPD or the Consumer Code, for example).

Therefore, there are various reasons that can lead to changes in the terms of use. All of them are relevant, especially to maintain the validity of this document and its applicability.

## Do I Need Authorization to Change the Terms of Use?

Yes! The terms are among the documents that clarify to the public what the rules are in that space, meaning on the website.

They join the [privacy policy](https://goadopt.io/en/blog/ideal-privacy-policy/) and the cookie notice to promote transparency with the user. While the terms indicate the applicable rules, rights, and duties, the policy pertains to privacy and data usage, which cookies are also part of.

All these documents are important because they assist in complying with LGPD regulations. Transparency is at its core.

Therefore, it wouldn't make sense for changes to the terms of use to occur without the consent of the user, right? It's not necessarily about authorization; after all, it's up to the user to decide whether to accept the terms, thereby maintaining access to the site's services and making their information available or to forfeit this and withdraw their consent.

In conclusion: whenever there are changes in rules and policies that affect users and data subjects, they must be notified to express their acceptance or rejection of the new rules and guidelines.

That's why changes are always announced for a future date, giving users ample time to read and understand the changes.

## My terms of use include a clause indicating the possibility of changing them, do I still need to notify users?

Once again, the answer is yes. Despite many terms and policies including the possibility of changes, it's not a good idea to change them without any notification and obtaining the consent of the data subject.

After all, this would be a unilateral change. Since terms of use function as an online contract, this isn't a favorable decision and can be seen as abusive. Likewise, it goes against LGPD, where transparency and consent are essential.

## How to Notify Your Users of Changes to the Terms of Use?

It's essential that you inform your users and customers of changes to your privacy policies and terms. Here are some tips on how to do it effectively.

## Notification by Message

One of the ways to notify your users of changes to the terms of use on your website is through message notifications. In this case, you can opt for email or other communication methods provided by the data subject (SMS, etc.).

In this scenario, inform users about the changes and provide access to the new terms. Similarly, ensure that when users access the document, they have the opportunity to indicate whether they accept these changes (in the famous "I declare that I have read and accept the terms of use" checkbox).

Additionally, make sure that this type of consent for changes is identifiable and properly archived as evidence.

## Notification upon Website Access

Another option is to have a banner that indicates changes to the terms of use appear as soon as the user accesses your website. In this scenario, it's advisable to prevent the user from navigating the page until they have read and agreed (or disagreed) with the new terms.

This practice is typically used when the new terms are already in effect, as it can have a more significant impact on the user experience. However, it's essential for both scenarios.

## Beware! Silence Does Not Imply Consent

Lastly, our final tip when changing the terms of use is to be careful regarding silence. Unlike what we often assume, silence does not imply consent. It's essential to obtain explicit consent from the data subject regarding changes to the terms.

## Help the Visitor Read the New Terms of Use!

Not all of your visitors, if not the minority, have the patience and interest to read your Terms of Use. Yes, this is concerning given its importance, but it's a fact we observe daily.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

So, since you'll already have to notify users of changes, a good practice is to highlight the main changes and how they might affect the user so they can quickly grasp the key points, accelerating their understanding and, consequently, the collection of their acceptance of the terms.

Do you have any questions or work as a [Data Protection Officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) and can contribute with these tips?

Please let us know how we can improve; we're always open to feedback!


Tips on how to notify users after a change on the Terms of Use.

When the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, the United States still had no federal privacy law. California decided not to wait and passed the most comprehensive data protection law in the country, which became the reference for virtually everything that followed.

Two years later, California voters went to the polls and approved Proposition 24, which created the [California Privacy Rights Act (CPRA)](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). And this is where things get a little confusing for outsiders.

This guide explains what each one is, what changed, and what the current California law requires from anyone handling data of state consumers.

## CCPA and CPRA: the same law or different laws?

Good question, and the answer is not simple.

The **CCPA** (California Consumer Privacy Act) is the original law. It was passed as AB 375 in 2018 and came into effect on January 1, 2020. It is codified at California Civil Code § 1798.100 to § 1798.199.100.

The **CPRA** (California Privacy Rights Act) is Proposition 24, passed by popular vote on November 3, 2020, with most provisions operative starting January 1, 2023. The CPRA did not create a separate law. It **amended and expanded** the CCPA. In other words: what exists today is the CCPA with the CPRA amendments incorporated.

### What the CCPA had originally

The 2020 CCPA guaranteed California consumers basic rights: knowing what was collected, requesting deletion of their data, and refusing the sale of their data. It was a pioneering and important law, but with significant gaps.

### What the CPRA changed starting in 2023

The CPRA made deep changes:

**Created the California Privacy Protection Agency (CPPA):** an independent regulatory agency with full administrative power to implement and enforce the law. Before, it was the Attorney General who enforced compliance. Now the CPPA has its own structure, investigative powers, authority to impose administrative fines, and a guaranteed budget.

**Added new rights:** the right to correct inaccurate data and the right to limit the use and disclosure of sensitive personal information.

**Created the "sharing" category:** separated "sale" from "sharing" for cross-context behavioral advertising. This means sharing data with advertising platforms for targeting, even without receiving money directly, now requires an opt-out.

**Expanded the definition of sensitive data:** added genetic data, neural data, health information, sexual orientation, and sex life.

**Required the "Limit the Use of My Sensitive Personal Information" link:** in addition to the existing "Do Not Sell or Share My Personal Information."

**Imposed data minimization and proportionate retention requirements.**

| Aspect | CCPA (2020) | CCPA + CPRA (2023) |
|---|---|---|
| Enforcement | Attorney General | CPPA (independent agency) + AG |
| Consumer rights | 5 rights | 7 rights |
| Required links | "Do Not Sell My Personal Information" | "Do Not Sell or Share" + "Limit Sensitive PI" |
| Sensitive data | Basic category | Expanded (includes neural data) |
| Private right of action | Security breaches only | Security breaches only |
| Full effect | Jan 2020 | Jan 2023 |

In the California articles on this blog, we cover the current law: **CCPA as amended by the CPRA**. For the specific CPRA changes, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

## What is the CCPA/CPRA today?

The California Consumer Privacy Act, as amended by the CPRA, is the most comprehensive data protection law in the United States. It guarantees broad rights to California consumers and creates detailed obligations for businesses that handle their data.

Enforcement today is shared between the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**, with distinct and complementary powers.

## When did the CCPA come into effect?

The original CCPA came into effect on **January 1, 2020**.

The CPRA amendments became operative on **January 1, 2023**.

The current version of the law, with all rights and obligations in effect, has applied since January 2023.

## Who needs to comply with the CCPA?

Under § 1798.140(d), the law applies to for-profit businesses that do business in California, collect personal information from consumers, and meet at least **one** of the following thresholds:

Annual gross revenues in excess of **US$ 25 million** in the preceding calendar year.

Annually buys, sells, or shares the personal information of **100,000 or more consumers or households**.

Derives **50% or more** of annual revenues from selling or sharing consumers' personal information.

The US$ 25 million threshold is the lowest among all US state privacy laws, making the CCPA the law with the broadest reach in terms of businesses affected.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### CCPA Exemptions

Exempt from most obligations:

Protected health information under HIPAA and data of covered entities.

Data regulated by the California Confidentiality of Medical Information Act.

Consumer credit information regulated by the Fair Credit Reporting Act.

Financial data regulated by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.

Data regulated by the Driver's Privacy Protection Act.

Academic or public health research data with appropriate safeguards.

Employee and job applicant data when used in that capacity.

## What is personal information under the CCPA?

Under § 1798.140(v), personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers such as name, address, IP address, email, Social Security number, driver's license, and passport number. It also includes commercial information, browsing history, geolocation data, audio and visual information, employment data, education data, and inferences drawn to create consumer profiles.

De-identified data and publicly available information are excluded.

## What is sensitive personal information under the CCPA/CPRA?

The CCPA, after CPRA amendments, has an expanded category of "sensitive personal information" (§ 1798.140(ae)):

Social Security number, driver's license, state identification card, or passport number.

Account login, financial account, debit or credit card number in combination with any required security code or password.

Precise geolocation (radius of 1,850 feet or less).

Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

Contents of a consumer's mail, email, and text messages, unless the business is the intended recipient.

Genetic data.

Neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system.

Processing of biometric information for unique identification.

Health information collected and analyzed.

Information about sex life or sexual orientation.

The inclusion of neural data is exclusive to the CCPA/CPRA among US state privacy laws.

## What are consumer rights under the CCPA/CPRA?

The law guarantees seven main rights:

**Right to know and access:** confirming whether the business processes their data and obtaining specific information collected, including categories of data, sources, purposes, third parties, and the specific pieces of personal information. The request covers the **preceding 12 months** (§ 1798.110, 1798.115).

**Right to deletion:** requesting deletion of personal data collected by the business, with the obligation to notify service providers, contractors, and third parties to also delete (§ 1798.105).

**Right to correction:** requesting correction of inaccurate personal data, added by the CPRA (§ 1798.106).

**Right to opt-out of sale and sharing:** directing the business not to sell or share personal data, exercisable at any time (§ 1798.120).

**Right to limit use of sensitive personal information:** restricting use of sensitive personal information to what is necessary to provide the products or services reasonably expected. Added by the CPRA (§ 1798.121).

**Right of non-discrimination:** exercising any right without being discriminated against by the business (§ 1798.125).

**Private right of action for security breaches:** filing a civil lawsuit for damages of US$ 100 to US$ 750 per consumer per incident. Unique among US state privacy laws (§ 1798.150).

The business has **45 days** to respond. The deadline can be extended by another **45 days** when reasonably necessary, with notification within the initial period. Service is free. The business is not obligated to provide information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## The two required links on the site

The CCPA/CPRA requires specific links on the business's homepage (§ 1798.135):

**"Do Not Sell or Share My Personal Information":** a clear and conspicuous link to a page where the consumer can opt out of sale and sharing of their data.

**"Limit the Use of My Sensitive Personal Information":** a link allowing the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services.

The business may use a single combined link for both purposes, as long as it clearly allows exercising both options.

Both links need somewhere to land. In practice that destination is a [privacy portal where the consumer submits and tracks the request](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/) — the same channel that receives access, deletion, and correction requests within the statutory deadline.

It is also possible to comply by honoring the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the user.

## "Sale" vs "sharing" under the CCPA/CPRA

This distinction created by the CPRA is fundamental.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or **other valuable consideration** to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for **cross-context behavioral advertising**, whether or not for monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): targeting ads based on personal information obtained from consumer activity across businesses, distinctly branded websites, applications, or services other than where the consumer is currently interacting.

In practice: if your site passes data to an advertising platform so it can display personalized ads to the user on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly.

## Cookies and the CCPA/CPRA

Cookies that collect personal information or allow user identification fall directly within the scope of the CCPA/CPRA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out of sale and sharing, block non-consented trackers, and honor the GPC.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies constitute sale or sharing and which require the opt-out links.

That same inventory is what you publish to visitors: a [CCPA cookie policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/) needs to list each category of tracker, its purpose, its retention period, and whether it results in sale or sharing of personal information.

## Protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization:

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: authorization from a parent or legal guardian.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

## The California Privacy Protection Agency (CPPA)

The CPPA (§ 1798.199.10) is governed by a five-member board with terms of up to eight years. It has power to:

Impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

Investigate businesses on its own initiative or based on complaints.

Conduct audits.

Issue and revoke regulations.

The Attorney General retains power to seek **civil penalties** of up to US$ 2,500 per violation and US$ 7,500 for intentional violations or violations involving minors.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act without any obligation to grant advance notice.

## The toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests. One of those methods must be, at minimum, a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

## Privacy notice: update every 12 months

§ 1798.130(a)(5) requires the business to update the privacy notice **at least once every 12 months**, including lists of the categories of data collected, sold, shared, and disclosed for business purposes in the preceding 12 months.

This is the annual review that keeps a [CCPA privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/) valid — an outdated notice is, in practice, a notice out of compliance.

## How AdOpt helps with the CCPA/CPRA

AdOpt records every consent and opt-out interaction, honors the GPC when sent by the user, blocks trackers before acceptance, and generates the auditable log needed in a CPPA or Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing CCPA/CPRA with other privacy laws

| Law | State | Threshold | Penalty | Enforcer | Effective Date |
|---|---|---|---|---|---|
| CCPA/CPRA | California | US$ 25M OR 100K consumers OR 50% revenue | Up to US$ 7,500/violation | CPPA + AG | Jan 2020/Jan 2023 |
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | AG | Jan 2023 |
| FDBR | Florida | US$ 1B+ global revenue | Up to US$ 50K/violation | Dept. Legal Affairs | Jul 2024 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | AG | Jan 2025 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | AG | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in structure and practical impact, our comparative guide goes deeper.

## Continue learning about privacy in California

The CCPA is the starting point, not the whole picture. To see what changed when Proposition 24 took effect, read our guide to the [CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). And to compare California's approach with the European and Brazilian models, see [how the GDPR, LGPD, and CCPA differ in practice](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/).

## The CCPA in practice: the three documents

Compliance with the CCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CCPA/CPRA

**1. What is the difference between the CCPA and the CPRA?**
The CCPA is California's original privacy law, in effect since January 1, 2020. The CPRA (Proposition 24) was passed by voters in November 2020 and amended the CCPA with full effect from January 2023. The CPRA is not a separate law: it modified and expanded the CCPA. The most important changes were the creation of the California Privacy Protection Agency (CPPA), the addition of rights to correct data and limit use of sensitive personal information, the separation of "sale" from "sharing," and the expanded definition of sensitive personal information.

**2. Who needs to comply with the CCPA?**
For-profit businesses that do business in California and meet at least one threshold: annual revenues exceeding US$ 25 million; buying, selling, or sharing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing personal data (§ 1798.140(d)).

**3. What is the difference between "sale" and "sharing" under the CCPA/CPRA?**
"Sale" is the transfer of data for monetary or other valuable consideration to third parties. "Sharing" is the transfer for cross-context behavioral advertising, with or without monetary consideration. The distinction ensures that advertising targeting practices are also subject to opt-out, even without direct payment to the site.

**4. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are mandatory links on the business's homepage (§ 1798.135). The first allows the consumer to opt out of sale and sharing of their data. The second allows limiting the use of sensitive personal information. They can be two separate links or a single combined link that clearly allows exercising both options.

**5. What is the private right of action under the CCPA and why is it unique?**
§ 1798.150 grants consumers the right to file a civil lawsuit when unencrypted and unredacted data is exposed in a security breach due to the business's failure to implement reasonable security measures. The consumer can recover US$ 100 to US$ 750 per incident or actual damages when greater. This private right of action is exclusive to the CCPA among US state privacy laws.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

To go further, see also [Global Privacy Control (GPC) Explained: What It Is and Who Has to Honor It](https://goadopt.io/en/blog/global-privacy-control-gpc-explained/).


California CCPA and Cookies: All You Need to Know

Global Privacy Control (GPC) is a setting a visitor turns on in their browser to tell every website they visit not to sell or share their personal data. The browser sends it automatically, so the visitor does not have to find an opt-out link on each site. For a website owner, it works like a standing opt-out request, and in several US states you have to treat it as one.

GPC matters most if you run ad pixels or analytics tied to advertising, because those are the tools the signal targets. This guide explains how the signal works, where the law requires you to honor it, and how to check that your site does, as part of wider [consent management across countries](https://goadopt.io/en/blog/consent-management-across-countries/).

## What is Global Privacy Control?

GPC is a specification, currently a W3C Working Draft, that defines how a browser tells a site about the visitor's privacy preference. It has two parts:

- An HTTP header called `Sec-GPC`, sent with every request, with the value `1` when the setting is on.
- A JavaScript property, `navigator.globalPrivacyControl`, which is `true` when the signal is on, so scripts on your page can read it.

Both come from the W3C specification at [w3.org/TR/gpc](https://www.w3.org/TR/gpc/). The visitor does not need to do anything on your site. Some browsers support it natively: [globalprivacycontrol.org](https://globalprivacycontrol.org/) lists Firefox (as a setting), Brave and DuckDuckGo (on by default), plus extensions such as Privacy Badger.

That last point is why GPC is hard to ignore. A visitor on Brave or DuckDuckGo sends it without having chosen anything, so a site that does not read it misses opt-outs it was legally required to respect.

## Who has to honor GPC?

The answer depends on where your visitors live. Today the clearest obligations are in the US. Rules change often, so treat this as a starting point and confirm with your lawyer.

### California

The California Attorney General says a global privacy control must be honored by covered businesses as a valid request to stop the sale or sharing of personal information. The [California Attorney General's CCPA page](https://oag.ca.gov/privacy/ccpa) also names GPC and says it is available in browsers like Firefox, DuckDuckGo and Brave, or as a browser extension.

The CCPA regulations back this up. Section 7025 says a business that sells or shares personal information must process an opt-out preference signal that meets the requirements as a valid opt-out request. The text does not name a specific signal, but the Attorney General's guidance does.

Enforcement has been real. In August 2022 the Attorney General announced a settlement with Sephora, with US$1.2 million in penalties. The settlement required Sephora to provide ways to opt out of the sale of personal information, including via the Global Privacy Control. For the wider California picture, see our guide to [California's CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

### Colorado and Connecticut

Colorado's Attorney General states that controllers must accept opt-out requests sent through universal opt-out mechanisms from July 1, 2024. Connecticut's Attorney General states that, starting January 1, 2025, controllers subject to the Connecticut Data Privacy Act must honor opt-out preference signals, and its page names Global Privacy Control as an example. Read more in our guides to [Colorado's CPA](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/) and [Connecticut's CTDPA](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

### Texas

Texas works differently. Its law lets a consumer name an authorized agent to opt out for them, using a technology that can include an internet browser setting or extension, or a global setting on a device. The business has to comply when it can verify the consumer and the agent's authority, and there are exceptions. So in Texas the signal is not a blanket GPC rule, and you should check your situation. Our guide to [Texas's TDPSA](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/) has more.

### Europe

We found no EU regulator guidance that requires websites to honor GPC. The GPC site itself says the signal supports rights under articles 7 and 21 of the GDPR, but that is the project's own claim.

The European Commission's Digital Omnibus proposal of 19 November 2025 would add a new article 88b to the GDPR on machine-readable signals of individual choices. It is a proposal, not law, and it does not name GPC. In Europe, the consent you collect in the banner remains the main control. Our guide to [GDPR and cookies](https://goadopt.io/en/blog/gdpr-cookies-explained/) covers it.

[See how AdOpt connects consent to your tags](https://goadopt.io/en/) if you serve visitors in more than one of these places.

## What honoring GPC looks like in practice

Honoring GPC means that, when the signal is on, your site stops selling or sharing that visitor's data. For most sites that means one thing: ad and cross-site tracking tags must not fire, or must run in a restricted mode, for that visitor.

A CMP does this for you when it reads the signal. For the curious, the idea looks like this:

```js
// Illustration only: a CMP does this for you
if (navigator.globalPrivacyControl === true) {
  gtag('consent', 'update', {
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied'
  });
}
```

This denies the Google consent types tied to advertising. Whether you also restrict analytics depends on how you use it and on the law that applies to the visitor. The same idea applies to the Meta pixel and any other ad tag. See [passing the choice to Meta](https://goadopt.io/en/blog/meta-pixel-consent-gdpr-and-ccpa/) and [GA4 cookie consent](https://goadopt.io/en/blog/google-analytics-4-cookie-consent/) for the tool-specific steps.

### GPC does not replace your opt-out link

The signal is one way to opt out, not the only one. California expects a clearly visible link, usually titled "Do Not Sell or Share My Personal Information", for visitors who do not use GPC. Keep both, and make sure they trigger the same result in your tags.

### Decide who gets the signal

Browsers send GPC from anywhere, including from countries where the law does not require you to honor it. You can honor it for everyone, which is the simplest setup, or only where required. Honoring it for everyone is easier to explain and test. Decide with your lawyer, and write the decision down in the [decision log](https://goadopt.io/en/blog/consent-management-across-countries/) we describe in our consent management guide.

## How GPC and your banner fit together

The banner and GPC do different jobs, and a good setup uses both. The banner is a conversation: you ask, the visitor answers, and you record the answer. GPC is a standing instruction that arrives before the visitor sees anything.

### The signal arrives first

The `Sec-GPC` header travels with the browser's requests, so your server can see it on the very first page load. A script can read `navigator.globalPrivacyControl` as soon as it runs. That order matters: the earlier your CMP reads the signal, the less likely an ad tag fires before the opt-out is applied.

### What the signal carries, and what it does not

The signal is a single value: `1`. It does not identify the visitor and it carries no reasons or details. That is a feature. You can apply it without collecting anything new, and you do not need to ask the visitor to confirm. What you do with it, and for which tags, is the part you have to decide and write down.

## A one-paragraph GPC policy for your team

A written rule keeps the setup alive when people change roles. A starting point you can adapt with your lawyer:

"When a visitor's browser sends Global Privacy Control, we treat it as an opt-out of sale and sharing of personal information for that visitor. Ad and cross-site tracking tags do not run, or run in their restricted mode, from the first page. We test this after every change to our tags and record the result."

Add who owns the test, how often it runs and where the evidence lives. Three lines, kept current, are better than a long document nobody opens.

## A timeline of the rules we verified

| Date | What happened | Source |
|---|---|---|
| 24 August 2022 | California announces the Sephora settlement, with US$1.2 million in penalties and a requirement to provide opt-outs including via GPC | California Attorney General press release |
| 1 July 2024 | Colorado controllers must accept opt-outs sent through universal opt-out mechanisms | Colorado Attorney General |
| 1 January 2025 | Connecticut controllers must honor opt-out preference signals | Connecticut Attorney General |
| 1 January 2025 | The Texas section on authorized agents takes effect | Texas HB 4, as enrolled |

Other states have similar rules. We list only the ones we could confirm in an official source, so check the laws that cover your visitors before you rely on this table.

## Mistakes teams make with GPC

Reading the signal is simple. Applying it everywhere is where sites slip:

- Checking GPC only after the first page has loaded, when ad tags have already fired.
- Honoring it for the banner but not for tags loaded outside the tag manager.
- Checking the signal once, on the first page, and not on later page views.
- Forgetting server-side events, which keep sending data the browser tag no longer sends.
- Not telling anyone what it does, so the next person to edit the setup removes it.

A short owner and a short test, repeated every time someone adds a tool, prevent most of these. If you manage several markets, the [decision log in our consent management guide](https://goadopt.io/en/blog/consent-management-across-countries/) is a good place to record it.

## How to test whether your site honors GPC

You do not need special tools, only a browser that sends the signal. Follow these steps:

1. Turn on GPC in a browser that supports it, such as Firefox (in settings) or Brave.
2. Open your site in a clean window, without clicking anything in the banner.
3. Open the browser's developer tools and check the network tab for requests to ad platforms such as Google Ads and Meta.
4. Check the console: `navigator.globalPrivacyControl` should return `true`.
5. Compare with a browser that does not send GPC. Requests should differ.
6. Save a screenshot and the date as evidence.

If ad requests still fire with GPC on, the signal is not wired to your tags. Start with any tags loaded outside your tag manager, which are the usual cause. Sorting your tags by purpose helps you find them.

## Where AdOpt fits

When you evaluate a CMP, ask whether it reads browser signals such as GPC and whether it passes the result to your tags. Our guide on [how to choose a CMP](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) lists the questions worth asking. [Compare AdOpt's plans](https://goadopt.io/en/plans/) and check how consent reaches your tags.

## Keep learning about opt-outs

- [California's DSAR privacy portal](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/)
- [How a cookie banner works](https://goadopt.io/en/blog/operation-of-cookie-banner/)

## Frequently asked questions

### Is GPC legally required?

In California, yes: the Attorney General says covered businesses must honor it as a valid request to stop sale or sharing. Colorado and Connecticut require honoring opt-out signals, and Texas has an authorized-agent rule with exceptions. We found no EU regulator guidance requiring it. Always confirm which laws cover your visitors.

### How can my site tell that a visitor uses GPC?

There are two ways. On the server, look for the `Sec-GPC` request header with the value `1`. In the browser, a script can read `navigator.globalPrivacyControl`, which is `true` when the signal is on. A CMP that supports GPC reads one of these for you and applies the opt-out to your tags.

### Does GPC stop all cookies?

No. GPC is an opt-out of sale or sharing. It does not ask you to turn off cookies that keep your site working, such as a login session or a shopping cart. It targets advertising and cross-context tracking. Which analytics tools are affected depends on how they are configured and on the rules that apply.

### Do I need to honor GPC for visitors outside the US?

Not necessarily. The clear obligations today are in US states, and we found no EU regulator guidance that requires it. Many sites honor it for every visitor because that is simpler to run and to explain. If you choose that route, record the decision and test it regularly.


All posts

How to delete cookies and cache in Chrome and other browsers?

Tips on how to notify users after a change on the Terms of Use.

California CCPA and Cookies: All You Need to Know

Global Privacy Control (GPC) Explained: What It Is and Who Has to Honor It