What CPRA Requires on Your Website, Specifically

The California Consumer Privacy Act (CCPA) passed in 2018. California voters amended it in 2020 with Proposition 24, the California Privacy Rights Act (CPRA), which took effect January 1, 2023. The CPRA is not a separate law. It rewrote the CCPA. When people say “CCPA/CPRA compliance,” they mean one law in its current, amended form.

Before you spend money retrofitting your website or buy a compliance plugin subscription, the first question is whether you are covered at all.

The CCPA as amended by the CPRA requires covered businesses to post a “Do Not Sell or Share My Personal Information” link, a privacy policy with specific disclosures, a notice at collection, and a mechanism to honor opt-out requests including browser-level Global Privacy Control signals. The law applies to for-profit businesses that operate in California and meet at least one of three thresholds: annual revenue above $26.625M (2025 figure), data on 100,000+ California residents or households, or deriving 50%+ of revenue from selling/sharing California residents’ personal information. Fines run up to $2,663 per violation or $7,988 per intentional violation as of 2025.

Does the Law Apply to Your Business?

This is the question most compliance content skips, because SaaS vendors who sell compliance tools have a financial interest in making the answer feel universally “yes.” It is not universally yes.

According to the California Privacy Protection Agency, the CCPA applies to for-profit businesses that do business in California and meet at least one of these three thresholds:

• Annual gross revenue of $26,625,000 or more (this number is CPI-adjusted biannually; it was $25M at the law’s original passage and increased to $26.625M as of January 1, 2025)
• Annually buy, sell, or share the personal information of 100,000 or more California residents or households
• Derive 50% or more of annual revenue from selling or sharing California residents’ personal information

If your business is a nonprofit or a government agency, the law does not apply. If your business is a for-profit company with under $26.625M in revenue and does not monetize data or process data at scale, you are likely not covered by the CCPA. You should still have a privacy policy as a matter of general practice, but the CCPA’s specific technical requirements are not your legal obligation.

The thresholds are independently sufficient. You only have to meet one. A business with $5M in annual revenue that runs a national newsletter and has 110,000 California subscribers on its list may be covered by the data volume threshold even though it is nowhere near the revenue threshold. Retargeting campaigns, marketing automation platforms, and analytics tools that aggregate California resident data can push a smaller business over the consumer-count threshold faster than founders expect.

If you are on the fence, that is a question for a privacy attorney, not a web development agency. We can implement whatever the attorney tells you is required. We cannot give you legal advice on whether you are covered.

The Six Things Your Website Must Have

Assuming you are covered, here is what the law requires to appear or function on your site. These are not policy decisions. They are implementation requirements.

1. A “Do Not Sell or Share My Personal Information” Link

The California AG’s office requires businesses that sell or share personal information to display a clear and conspicuous link with this exact phrase, or an approved alternative. The CPPA’s FAQ also accepts “Your Privacy Choices” or “Your California Privacy Choices” as link text. The link must appear in the footer or header of your website. It must allow a consumer to individually opt out of the sale or sharing of their personal information with that specific business. It must not require account creation to access.

This is where most small websites fail the technical implementation. The link is not a checkbox in your cookie banner. It is a functional mechanism that, when clicked, triggers an opt-out request that your business must process within 15 business days. If you use a third-party ad platform that receives user data, clicking that link must actually stop that sharing, not just display a preference center.

2. A “Limit the Use of My Sensitive Personal Information” Link

The CPRA added a new category: sensitive personal information (SPI). This includes Social Security numbers, financial account credentials, precise geolocation, health data, biometric identifiers, contents of private communications, racial or ethnic origin, religious beliefs, and union membership. If your business uses or discloses SPI for purposes beyond delivering the requested service, you must provide a separate link on your homepage allowing consumers to limit that use.

For most small business websites, this requirement does not trigger. If you are not processing health data, biometrics, or precise location data beyond what is needed to fulfill an order, you likely have no SPI to restrict. But if you run a fitness app, a healthcare portal, or any platform collecting detailed personal characteristics, this is a separate link with its own backend process.

3. A Notice at Collection

Before or at the point you collect personal information, you must notify users of the categories of information you are collecting and the purposes for which it will be used. On a WordPress site, this typically means a short disclosure on your contact form, your checkout page, and any signup form. It does not have to be a full privacy policy. It is a contextual notice that links to the full policy for anyone who wants more detail.

A WooCommerce checkout that collects name, address, email, and payment data needs a notice at collection. A simple contact form that sends an inquiry email probably needs one too, because you are collecting personal information (an email address and a name) even if you do not share or sell it.

4. A CCPA-Compliant Privacy Policy

Your privacy policy must disclose the categories of personal information you collect, the purposes for collection, the categories of third parties with whom you share information, and instructions for consumers to exercise all six of their CCPA rights. Those rights are: Right to Know, Right to Delete, Right to Correct, Right to Opt-Out of sale/sharing, Right to Limit use of sensitive personal information, and Right to Non-Discrimination.

The privacy policy must be updated at least once every 12 months. It must include the effective date. It must explain how consumers can submit requests, including the two designated methods (see item 5 below). If you sell or share data, the policy must include the “Do Not Sell or Share” link there as well. The policy must be accessible from a footer link using the word “privacy” in the link text.

5. At Least Two Methods for Submitting Consumer Requests

Consumers must be able to submit Know, Delete, and Correct requests through at least two designated channels. One method must be a toll-free phone number. One must be a web form if you have a website (and if you are reading this, you do). Businesses operating exclusively online only need an email address. You cannot require consumers to create an account to submit a request.

The response timeline matters. For Know, Delete, and Correct requests, you have 45 calendar days, extendable to 90 with notice. For Opt-Out requests, the law requires action as soon as feasibly possible, up to 15 business days. These are operational requirements, not just web requirements. Your website needs the intake mechanism. Your team needs a process to handle what comes in.

6. Global Privacy Control (GPC) Signal Support

This one catches businesses off guard. The Global Privacy Control is a browser-level signal, built into Firefox, Brave, and DuckDuckGo (and available as extensions for others), that tells websites: “do not sell or share this user’s data.” More than 150 million users have it enabled.

Per the California AG’s office, covered businesses must honor a GPC signal as a legally valid opt-out request. It is not optional. It functions the same as a consumer manually clicking your “Do Not Sell or Share” link. If your website runs Google Analytics, Meta Pixel, or any advertising tag that receives user data, and a visitor sends a GPC signal, you are legally required to suppress that data sharing for that visitor.

On a WordPress site, GPC support typically requires a properly configured consent management platform (CMP) that reads the GPC header and fires or blocks tags accordingly. A basic cookie banner that just dismisses the notice does not handle this. Google Consent Mode v2 integration, combined with a CMP that respects the GPC signal, is the standard implementation path for most WordPress and WooCommerce builds.

What CCPA Does Not Require (The GDPR Confusion)

Most of the confusion we encounter comes from business owners who have read about GDPR cookie consent requirements and assume CCPA works the same way. It does not.

GDPR is opt-in by default. Under GDPR, cookies cannot fire until a user actively consents. CCPA is opt-out by default. Under the CCPA, cookies and tracking technologies can run unless a user specifically opts out. You do not need to block all scripts behind a “Accept All / Reject All” wall to be CCPA-compliant. You need to give users a way to opt out, and you need to honor that request when they exercise it.

This distinction matters for conversion rate optimization. A GDPR-style hard-gate banner on a US-only audience costs you data on every non-consenting visitor and can significantly degrade your ad targeting. A properly built CCPA opt-out mechanism allows tracking by default and suppresses it only for users who explicitly opt out. The user experience is fundamentally different, and the implementation is less disruptive to your analytics and attribution.

That said, if you serve visitors from both California and the EU, you need a geo-aware consent layer: GDPR opt-in mechanics for European visitors, CCPA opt-out mechanics for California visitors. That is a more complex build, and combining them incorrectly creates compliance gaps in both directions.

The Penalty Reality

Noncompliance is not a theoretical risk. The California Privacy Protection Agency announced in December 2024 that fines and thresholds were adjusted effective January 1, 2025. Administrative fines now run up to $2,663 per violation for unintentional violations and up to $7,988 per violation for intentional violations or any violation involving the personal information of consumers known to be under 16.

The word “per violation” deserves attention. A single website serving a non-compliant opt-out mechanism to thousands of California residents is not one violation. Civil damages for a data breach run $107 to $799 per consumer per incident. For a WooCommerce store with 5,000 California customers, a breach resulting from inadequate security practices is a material financial exposure, not a nuisance fine.

The CPPA also finalized regulations on Automated Decision-Making Technology (ADMT) in 2025. If your website uses algorithms to make significant decisions affecting consumers (employment, housing, financial services, healthcare), you will need to comply with additional notice and opt-out requirements by January 1, 2027. This is not a current website requirement for most small business sites, but any business using AI-driven lead scoring, pricing engines, or eligibility tools should track this.

The WordPress Implementation Picture

Most small to mid-market business websites run on WordPress. Here is what a CCPA/CPRA retrofit typically involves for a WordPress site:

A consent management plugin handles the opt-out link, the privacy preference center, and in most configurations the GPC signal detection. The CookieYes plugin on WordPress.org is one commonly used option; Termly, Complianz, and Usercentrics also integrate with WordPress via plugin. The right choice depends on your ad stack and whether you need Google Consent Mode v2 compatibility.

The privacy policy and notice at collection require content updates, not necessarily a plugin. These are page edits and form modifications. A developer needs to add the notice text to contact forms and checkout pages, and ensure the privacy policy link appears in the footer with compliant link text.

The “Do Not Sell or Share” footer link is usually a page anchor or a dedicated privacy preferences page, not just a static text link. It needs to connect to your CMP’s preference center, which means the plugin and the theme footer have to talk to each other. On a heavily customized WordPress theme, this sometimes requires bespoke work rather than a plugin drop-in.

GPC support is where implementations most often fall short. The CMP must be configured to read the Sec-GPC: 1 request header and suppress your ad tags and analytics accordingly. If your consent mode setup pre-dates 2024, it probably does not do this correctly.

What This Costs to Fix

No honest answer to this question is a single number. The range depends on your current site, your ad stack complexity, and whether you already have a privacy policy.

For a straightforward WordPress site with standard tracking (Google Analytics 4, one Meta Pixel, a contact form): a compliance retrofit typically runs $800 to $2,500 in development time, depending on the complexity of the theme footer, the CMP you choose, and whether your existing privacy policy needs a full rewrite. Ongoing plugin licensing for a commercial CMP runs $120 to $500 per year.

For a WooCommerce store that processes customer data and runs retargeting across multiple platforms, the build is more involved. You have customer data in your database, order history, and potentially third-party integrations (Klaviyo, HubSpot, Mailchimp) that each receive personal information. A proper audit of those data flows, plus the technical implementation, is likely in the $2,500 to $6,000 range.

We scope these based on an actual review of your site and your ad stack. A quote without that review is a guess.

FAQ

Does CCPA/CPRA apply to businesses outside California?

Yes, if the business meets one of the three thresholds and does business in California, regardless of where the company is incorporated or headquartered. A company based in Texas with $30M in revenue and California customers is covered. The law is about where your consumers are, not where you are.

Do I need a cookie banner to comply with CCPA?

No. CCPA does not require a cookie consent banner the way GDPR does. The CCPA uses an opt-out model, not an opt-in model, so tracking can run by default. You need an opt-out mechanism (the “Do Not Sell or Share” link, GPC support, and a preference center), but you do not need to block scripts behind an accept/reject wall for US visitors. A GDPR-style consent gate on a US-only audience is overcompliant and typically hurts your analytics and ad attribution without any legal requirement to do so.

What is the difference between CCPA and CPRA?

CPRA is an amendment to CCPA, not a separate law. California voters passed CPRA in November 2020 as Proposition 24. It took effect January 1, 2023. CPRA added the Right to Correct, the Right to Limit use of sensitive personal information, the concept of sensitive personal information as a distinct category, data minimization and purpose limitation requirements, and created the California Privacy Protection Agency as a dedicated enforcement body. When people refer to “CCPA/CPRA,” they mean the CCPA as currently amended by CPRA.

What happens if my website is not compliant and someone files a complaint?

The CPPA can investigate, audit, and bring administrative enforcement actions. Fines run up to $2,663 per unintentional violation and $7,988 per intentional violation or violation involving minors (2025 figures). Consumers cannot sue businesses for most CCPA violations. The exception is a data breach caused by inadequate security: consumers can sue for $107 to $799 per incident in statutory damages, or actual damages if higher. Before suing, they must give the business 30 days written notice to cure.

Does CCPA/CPRA apply to employee data or B2B data?

As of January 1, 2023, no. The exemptions for employee data and business-to-business transaction data that were in the original CCPA expired on December 31, 2022. Employee personal information and B2B contact data are now subject to CCPA/CPRA requirements for covered businesses.

What is Global Privacy Control and do I have to honor it?

GPC is a browser-level signal built into Firefox, Brave, DuckDuckGo, and available as browser extensions. It tells websites that the user wants to opt out of the sale or sharing of their personal information. Under CCPA, covered businesses are legally required to honor it as a valid opt-out request. It is not a courtesy. If your website loads tracking pixels or advertising tags and a visitor sends a GPC signal, you must suppress that data sharing for that visitor as if they had clicked your “Do Not Sell or Share” link manually.

The Next Step

If you are a covered business and your website was built before 2023, it almost certainly needs updates. The specific scope depends on your tech stack, your ad platform integrations, and how your current theme handles footer links and form disclosures.

We do not sell compliance subscriptions or legal opinions. What we do is review your site, map your data flows, and tell you exactly what needs to change at the code and content level. If the scope is small, we will tell you. If a plugin handles 80% of it, we will say that too.

If you want a specific, honest assessment of what your WordPress or WooCommerce site needs to meet CCPA/CPRA website requirements, request a scoped compliance review and we will come back with a fixed scope and a flat price.