Search every question across sub-FAQs

Apply the definition to the entity, not to a product label. Confirm that the entity is a CCPA business, knowingly collects personal information, sells that information to third parties, and lacks a direct relationship with the affected consumers. Then check the statute's exclusions, including specified consumer-reporting, financial, insurance, and health-data activities.

A direct relationship exists when the consumer intentionally interacts with the business, but the exact facts matter. Buying data indirectly, collecting it from public sources, or operating a consumer-facing site does not by itself resolve whether the business has a direct relationship with each affected consumer.

Keep separate evidence for the data-broker classification and for each recurring duty. A registration receipt does not show that DROP requests, vendor instructions, or ordinary CCPA requests were handled.

Do not collapse the two regimes into one generic privacy workflow. The CCPA and Delete Act use related concepts but impose different submissions, dates, system interactions, and records.

Review every interface used to obtain CCPA consent or let a consumer exercise a right. The regulations require easy-to-understand communications, plain and straightforward language, and symmetry in choice so the interface does not impair the consumer's ability to select the more privacy-protective option.

Intent is not the test. An interface can be a dark pattern because of its effect even if no one designed it to mislead. Consent gathered through that interface does not satisfy the CCPA.

Keep evidence that shows what a consumer saw and how each path behaved at release time. A policy alone cannot show the wording, visual hierarchy, number of steps, default state, or whether a preference persisted.

A screen can look balanced in isolation and still be part of a dark pattern. Review the full sequence, the consequences of each selection, and what happens when a consumer returns later.

Inventory each disclosure by recipient, data category, purpose, consideration, advertising context, contract, and actual recipient use. A vendor label does not decide the analysis. A service provider or contractor must meet the statutory definition and written-contract restrictions; otherwise the recipient may be a third party.

A business that sells or shares must provide two or more designated opt-out methods suited to how it interacts with consumers. For online collection, those methods include processing a qualifying opt-out preference signal and providing an interactive form through the required link, alternative link, or privacy policy. A business may omit the link only if it meets every condition for frictionless signal processing; posting a cookie banner alone is not an opt-out method.

The request applies without identity verification, although the business may ask for information reasonably necessary to complete it. Stop covered transfers as soon as feasibly possible and no later than 15 business days, give the consumer a way to confirm completion, notify affected downstream third parties as required, use request data only to comply, and wait at least 12 months before asking the consumer to authorize sale or sharing again, subject to the regulations.

Keep transaction-level scope evidence and end-to-end opt-out test results. A homepage link does not prove that advertising tags, server-side transfers, offline systems, and known accounts stopped the covered activity.

Scope errors usually come from classifying a transfer by vendor name or payment method instead of the recipient, purpose, consideration, advertising context, contract, and actual use.

Start with the actual exchange. Identify the personal information the program collects, retains, sells, or shares; the benefit, payment, price, or service difference the consumer receives; and whether the difference is reasonably related to the value that the data provides to the business.

Give the Notice of Financial Incentive before the consumer opts in. The notice must summarize the program, describe its material terms and implicated personal-information categories, explain how to opt in and withdraw, state a good-faith estimate of the value of the consumer's data, and explain the calculation method and why the price or service difference is reasonably related to that value. Consent must be prior, affirmative, specific to the program, and revocable at any time.

Section 7081 permits several valuation approaches, including marginal or average value, aggregate value divided by the number of consumers, revenue or profit generated from the data, expenses connected to the data, and the cost of the incentive. A business may use another practical and reasonably reliable good-faith method. The calculation must support the actual benefit or difference offered; naming a method without its inputs and relationship to the program is not enough.

Keep the commercial analysis, consumer-facing notice, consent event, and live program behavior together. The notice should match the benefit, eligibility, data uses, withdrawal result, and valuation method that the program actually uses.

Classify each discount from the actual exchange. The business must connect the specific difference to the value of the consumer's data and operate the program consistently with the disclosed terms.

Process the signal for the browser or device that sends it and every consumer profile, including a pseudonymous profile, associated with that browser or device. If the business knows the consumer, treat the signal as applying to the consumer, their account, and identifiable offline sale or sharing. Do not wait for a separate form, account creation, or identity verification.

A qualifying signal must use a format commonly used and recognized by businesses, such as an HTTP header or JavaScript object, and the sending mechanism must tell the consumer that the signal is meant to opt out of sale and sharing. The regulations do not require the disclosure to mention California. The GPC specification expresses the signal through the Sec-GPC header and the navigator.globalPrivacyControl JavaScript property, but the legal test is section 7025 rather than a product name alone.

If the signal conflicts with a business-specific setting that permits sale or sharing, process the opt-out first. The business may explain the conflict and seek fresh consent through a compliant choice. A financial-incentive conflict has a separate confirmation branch. Absence of the signal on a later visit is not consent to opt in when the consumer is known to the business.

GPC is not a delete request and does not by itself withdraw every form of consent or limit every use of sensitive personal information. Scope it to the CCPA sale and sharing opt-out unless another applicable signal or consumer instruction communicates an additional choice. Stop covered sale or sharing as soon as feasibly possible and no later than 15 business days after receipt.

Keep end-to-end evidence for recognized and unrecognized users. A server log showing that the header arrived does not prove that downstream sale or sharing stopped.

A confirmation in one layer does not cure sale or sharing that continues through another layer. Test the full transfer path.