CCPA for Marketers: What California's Law Requires

After I published my GDPR guide, the most common follow-up was some version of “and California?”, usually from US marketers who had quietly assumed the CCPA was GDPR with palm trees. It is not. The California Consumer Privacy Act, as amended by the CPRA, is built on a different chassis: it never asks you to name a lawful basis for processing, and instead concentrates its force on two things marketers do constantly, moving personal data into the adtech ecosystem and making privacy rights hard to use. This is my plain reading of the parts that bind marketing work, each claim linked to the regulator’s own text, with the same disclaimer as the GDPR piece and the rest of my governance series: I am a marketer reading law, not a lawyer.

Who the law actually covers

The CCPA applies to for-profit businesses doing business in California that clear any one of three thresholds, listed on the Attorney General’s CCPA page: gross annual revenue over $25 million, buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving half or more of annual revenue from selling Californians’ personal information. Notice what is not in that list: an office in California. Like GDPR, the law follows the people. A SaaS company in Austin with California customers in its CRM and a retargeting pixel on its site is plausibly in scope on the second threshold alone, because 100,000 residents or households is a low bar for any consumer site running third-party tags.

My advice to teams near the line is to comply as if covered, partly because the thresholds are easier to cross than to monitor, and partly because nineteen-odd other states have now passed cousins of this law. Building marketing operations for the strictest state you sell into is cheaper than building them per state.

“Sale” and “sharing”: the words that catch your ad stack

The load-bearing definitions. A sale is an exchange of personal information for money or other valuable consideration. Sharing, added by the CPRA, means disclosure for cross-context behavioral advertising, defined on the AG’s page as targeting ads to a consumer based on personal information obtained from their activity across other businesses’ websites. Read that definition again with your tag manager open. Retargeting pixels, custom audience uploads, adtech cookie syncs and data co-ops all move personal information to third parties for exactly that purpose. The regulators’ consistent position is that this counts, whether or not money changes hands, and consumers therefore get a right to opt out of it, which is what the “Do Not Sell or Share My Personal Information” link exists to deliver.

This is the single biggest gap I find in marketing stacks: a privacy policy that says “we do not sell your data” written by someone who thinks sale means invoices, sitting on a site whose every page fires behavioral advertising tags. Under the CCPA’s definitions, that sentence is a false statement in exactly the place enforcement reads first.

The rights, and the one signal that automates them

Californians hold five rights the AG’s page summarizes: to know what is collected about them, to delete it, to correct it, to opt out of sale and sharing, and to limit use of sensitive personal information. For marketing operations, the opt-out is the one that reshapes daily work, and it comes with a technical hook: businesses must honor the Global Privacy Control, a browser signal that transmits the opt-out automatically, as a valid consumer request. No form, no email, no verification flow. If a visitor’s browser sends GPC and your tags keep sharing, you are violating the law with no human on either side ever noticing.

The right to delete, like GDPR’s objection right, is mostly an architecture problem. The request arrives at one door and the data lives in six tools. When I map a client’s stack for this, the same discipline as my GDPR audit, the question is always whether a deletion actually propagates to the email platform, the CDP, the ad accounts and the spreadsheets nobody admits to.

What enforcement has actually punished

Three actions tell you what regulators care about, and all three are about marketing.

Sephora, the first public CCPA settlement, announced in August 2022: $1.2 million, for failing to disclose it was selling personal information and for ignoring GPC signals, where the “selling” at issue was third-party analytics and advertising tags on its website. Not a data broker. A retailer with a normal marketing stack.

DoorDash, announced in February 2024: $375,000, for selling customer data through marketing cooperatives, the arrangements where companies pool customer lists to prospect from each other’s audiences, without notice or an opt-out. If your growth team is in a data co-op, this case is addressed to you.

Honda, the California Privacy Protection Agency’s March 2025 order: $632,500, and to me the most instructive of the three. Honda’s violations were process design: demanding excessive information to verify opt-out requests, making opting out of cookies harder than opting in (two clicks versus one, an asymmetry the order calls out), mishandling requests from authorized agents, and failing to produce proper contracts with its adtech vendors. Consent flows engineered to tilt the outcome are the territory I mapped in the dark patterns post, and Honda is what it looks like when a regulator reads your cookie banner as a design artifact.

The penalty math behind these numbers sits in Civil Code section 1798.155: up to $2,500 per violation, $7,500 per intentional violation or violations involving minors, assessed per consumer, which is how ordinary-sounding fines scale into serious ones. Consumers themselves can sue only over data breaches, with statutory damages up to $750 per incident, so the enforcement you plan for is the regulator, not the class action, except when security fails.

The Tuesday-afternoon version

What I would actually do as a marketing team. Inventory every tag, pixel, audience upload and data partnership, and label each one honestly against the sale and sharing definitions, because the whole law turns on that labeling. Put the “Do Not Sell or Share” link where the statute wants it and wire it to actually stop the tags, which is a consent management platform task, not a copywriting task. Test GPC with a browser that sends it, and watch what your tags do. Make opting out exactly as easy as opting in, count the clicks, because a regulator did. Check that deletion requests reach every system holding the data. And get your vendor contracts in order, since Honda was fined partly for contracts it could not produce. If you use AI tools on customer data, the same vendor discipline I described for GDPR and AI tools applies here unchanged. The structural fix runs deeper than any checklist: the less your marketing depends on moving data to third parties, the less of this law touches you, which is the long-term case for a first-party data strategy.

FAQ

We are a B2B company. Does the CCPA reach us? Yes. Since 2023 the law’s full rights apply to employment and business-contact data too, so the exemption B2B marketers relied on is gone. A lead in your CRM who lives in California holds the same rights as a consumer.

How is this different from GDPR in one paragraph? GDPR forbids processing without a lawful basis, so the burden sits before the data moves. CCPA permits processing but grants rights against it, above all the right to stop sale and sharing, so the burden is honoring rights fast and honestly. A stack built for GDPR consent gets you most of the way, but GPC support and the sale and sharing disclosures are CCPA-specific work.

Do we need consent before collecting data, like the EU? Generally no, for adults. The CCPA model is opt-out, not opt-in, with the notable exception of minors, where selling or sharing requires opt-in consent and the fine tier doubles. That opt-out model is exactly why the GPC signal matters so much: it is the mechanism that makes the opt-out real.

Which states copied this, and do I need seventeen playbooks? A growing majority of US states now have comparable laws with varying thresholds and rights. I run one playbook tuned to the strictest common denominator, which today mostly means California, and I track the deltas rather than maintaining parallel processes. For the AI-specific legal layer on top, see the FTC’s rules for AI in advertising and the EU AI Act checklist.

This guide is part of my ethics and governance series. The EU half of the privacy map is GDPR for marketers, the consent-design failures regulators keep fining are in dark patterns in AI marketing, and the US advertising-claims layer is the FTC’s AI rules.