CCPA / CPRA basics
CCPA protects personal information about California residents. In an ecommerce tracking context, that can include account data, order events, device identifiers, cookie IDs, hashed emails, IP addresses, geolocation, and advertising IDs when they can identify or be reasonably linked to a consumer or household. Moving the collection point from browser pixels to a server route improves control, but it does not remove the privacy obligations attached to the data.
The law applies to for-profit businesses that do business in California and meet key thresholds: annual gross revenue over $25 million, buying, selling, or sharing personal information of more than 100,000 consumers or households, or deriving more than 50% of annual revenue from selling or sharing personal information. A merchant outside California can still fall in scope if it serves California residents and meets one of those tests.
CPRA amended CCPA and added the sensitive personal information category, usually shortened to SPI. SPI includes high-risk data such as precise geolocation, government IDs, account credentials, financial account data, health information, biometrics, and characteristics such as race, religion, union membership, and sexual orientation. Server-side tracking should classify those fields before routing because SPI can trigger a consumer's right to limit use and disclosure.
Key differences from GDPR
GDPR and CCPA / CPRA both regulate personal data, but the operating model is different. GDPR starts from lawful basis and often prior consent. California law focuses heavily on notice, opt-out, consumer rights, and specific rules for sale, sharing, and sensitive personal information.
| Aspect | GDPR | CCPA/CPRA |
|---|---|---|
| Primary model | Opt-in and lawful-basis framework. Processing needs a legal basis before personal data is collected or used. | Notice and opt-out framework. Businesses must disclose practices and honor California rights, including sale and sharing opt-outs. |
| Scope of individuals | Applies to data subjects in the EU and EEA, with UK and Swiss regimes operating under related but separate laws. | Applies to California residents, including consumers, households, and in some contexts employee or B2B records. |
| Advertising rule | Behavioral advertising commonly requires prior consent because it usually relies on cookies, identifiers, and profiling. | Cross-context behavioral advertising is sharing under CPRA, which triggers opt-out rights even when no money changes hands. |
| Sensitive data | Special category data has stricter processing rules and usually requires explicit consent or another narrow condition. | CPRA creates sensitive personal information and gives consumers a right to limit some uses and disclosures. |
| Request deadlines | Requests generally require response without undue delay and within one month, with limited extensions. | Consumer requests generally require response within 45 days, with extension rules when more time is reasonably necessary. |
Consumer rights
CCPA rights need operational plumbing. A privacy policy can state the rights, but the tracking stack also needs lookup, suppression, export, deletion, correction, and audit controls tied to the identifiers used in server-side events.
Right to know
Consumers can ask what categories and specific pieces of personal information the business collected, used, disclosed, sold, or shared. Tracking data can be part of that response when it is linked to the consumer or household.
Right to delete
Consumers can ask the business to delete personal information, subject to exceptions. Server-side event stores, delivery logs, and identifier maps need a repeatable deletion workflow.
Right to correct
Consumers can ask for inaccurate personal information to be corrected. Merchants should be able to identify records that can reasonably be corrected and distinguish them from immutable audit records.
Right to opt-out of sale/sharing
Consumers can opt out when personal information is sold or shared, including sharing for cross-context behavioral advertising under CPRA. The opt-out must propagate before advertising destinations receive events.
Right to limit SPI use
Consumers can limit certain uses and disclosures of sensitive personal information when the business uses it beyond permitted purposes. SPI classification matters before payloads reach tracking systems.
Right to non-discrimination
Businesses cannot unlawfully discriminate against consumers for exercising CCPA rights. Any price, service, or experience difference needs careful legal review and clear disclosure when allowed.
Sale vs Sharing vs Processing
A sale is not limited to exchanging personal information for cash. Under CCPA, sale can include making personal information available to another party for monetary or other valuable consideration. That means some advertising, enrichment, marketplace, affiliate, or data collaboration arrangements need careful review even when the contract does not call the exchange a sale.
CPRA separately regulates sharing, which covers disclosure of personal information for cross-context behavioral advertising. The point is whether the data helps target ads based on activity across businesses, sites, apps, or services. Retargeting and ad platform optimization can therefore count as sharing even if no money changes hands and even if the merchant sees the activity as ordinary campaign measurement.
Processing is broader. It includes collecting, using, retaining, disclosing, analyzing, deleting, or otherwise handling personal information. Server-side tracking processors can support a business by routing events under instructions, but the business still has to decide whether each destination activity is a sale, sharing, service-provider processing, contractor processing, or a permitted internal use.
Required UX elements
California compliance should be visible and usable. The consumer must be able to find the required choices without searching through account settings or guessing which banner button controls advertising disclosures.
- Do Not Sell or Share My Personal Information link in the site footer.
- Limit the Use of My Sensitive Personal Information link when sensitive personal information is collected and used beyond permitted purposes.
- Privacy policy with specific CCPA-required sections covering categories collected, sources, purposes, disclosures, rights, request methods, retention, and sale or sharing practices.
- Consumer request handling that verifies the request where required and responds within 45 days unless a valid extension applies.
- Cookie banner with opt-out controls and Global Privacy Control signal support where sale or sharing may occur.
Global Privacy Control (GPC)
Global Privacy Control is a browser-level privacy signal. When a consumer uses a browser, extension, or user agent that sends the header Sec-GPC: 1, covered businesses must treat that signal as a valid opt-out of sale and sharing for that browser or device. The signal has to be honored without requiring the consumer to find another toggle first.
Server-side tracking needs to preserve GPC state from the edge of the request through event enrichment, consent evaluation, and destination dispatch. If the browser says Sec-GPC: 1, the server should attach that state to the event and suppress destinations or fields that would create sale or sharing. Logging the decision matters because privacy teams need proof that the signal was detected and enforced.
TrackLayer CCPA features
TrackLayer is built to make California privacy controls enforceable inside the event pipeline. The goal is to connect consumer choices with destination behavior, not leave opt-outs as a policy statement that the tracking stack cannot apply.
Opt-out propagation
TrackLayer carries sale and sharing opt-out state into destination policy so ad platforms, analytics tools, and conversion APIs receive only the events allowed by the consumer's privacy choice.
SPI classification
Payload fields can be classified for sensitive personal information risk, helping teams block or transform restricted values before they enter server-side tracking flows.
Audit logs
TrackLayer records consent state, destination decisions, request actions, and suppression outcomes so privacy teams can prove how opt-outs and consumer requests were applied.
Consumer request API endpoint
A dedicated endpoint supports lookup, export, suppression, and deletion workflows so support and privacy operations can connect CCPA requests with tracking records.
Data residency
US region processing gives California-focused merchants a regional option for ingestion, routing, logs, and retention without forcing the workload through an EU region.
Penalties
CCPA enforcement can reach $2,500 per violation and $7,500 per intentional violation or certain violations involving children. In tracking systems, a violation can multiply quickly when the same defective opt-out, privacy notice, or destination rule affects many consumers or many events.
CCPA also includes a private right of action for certain data breaches involving nonencrypted and nonredacted personal information when reasonable security procedures were not maintained. That makes security controls, access logs, encryption, retention, and incident response part of the privacy program, not separate technical hygiene.
What counts as SPI
Sensitive personal information should be inventoried before it can enter event payloads, customer audiences, logs, warehouses, or ad platform integrations. Common SPI categories include:
FAQ
Do other US state privacy laws work the same way?
No. Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, Delaware, and other states have overlapping rights but different definitions, thresholds, appeal rules, and sensitive data requirements. Build a state-aware control model instead of hardcoding California-only logic.
Is B2B data in scope?
California's rules can cover personal information collected in business-to-business contexts. A work email, device identifier, or lead record can still identify a California resident, so B2B tracking should not be assumed out of scope.
What about child-specific protections and COPPA?
CCPA has stricter rules for sale or sharing involving consumers under 16, and COPPA can apply to online services directed to children under 13 or with actual knowledge of child users. Child data requires a separate review before advertising or analytics activation.
Is employee data treated differently?
Employee and applicant data can be subject to California privacy obligations, but operational requirements may differ from consumer ecommerce tracking. Treat workforce analytics, support tooling, and recruiting data as separate inventories with separate notices.
Does CCPA matter if my company is outside California?
It can. The trigger is not where the business is headquartered; it is whether the business does business in California, meets the statutory thresholds, and collects personal information about California residents.