CCPA / CPRA: when sharing becomes a sale.
California’s consumer privacy law treats much of ad tech as the “sale” or “sharing” of personal data, and requires sites to honor opt-outs, including the Global Privacy Control signal.
The law in brief.
California Consumer Privacy Act, as amended by the CPRA (Civil Code §1798.100 et seq.)
California Privacy Protection Agency and the California Attorney General
Limited to data breaches; privacy-practice exposure is mainly regulatory
Up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (amounts adjusted January 1, 2025)
Disclosure, a working Do Not Sell/Share opt-out, honoring GPC, and data-subject request handling
What creates the exposure.
Global Privacy Control signal ignored
Consent & Preference Signals →
Visitor data sent to registered data brokers
Data Brokerage & Sharing →
Advertising data shared without a working opt-out
Tracking & Advertising →
Tracking that continues after an opt-out
Consent Failure →
A privacy policy that doesn’t match the site
No route for access or deletion requests
Opt-outs, tested, not just detected.
Report indicators
Risks tied to this law
- Global Privacy Control signal not honored
- Data broker interaction
- Advertising tracking despite opt-out selection
- Cross-device identity matching for advertising
Global Privacy Control signal not honored
Example finding. Vendor names are withheld.
How to respond.
“Does the site honor Global Privacy Control?”
“Does the Do Not Sell/Share link actually stop sale and sharing tracking?”
“How are access and deletion requests handled?”
“Implement GPC detection and a working Do Not Sell/Share opt-out, verified by CyRisk rescan.”
Regulatory coverage terms, with closer review for California-heavy customer bases.
Keep exploring.
Exposure families behind this law
Other laws
Does CCPA create class-action exposure?
Its private right of action is limited to data breaches. Privacy-practice findings mostly point to regulatory exposure, though the same facts often support wiretap or UDAP claims.
What does CyRisk test for CCPA?
The Do Not Sell/Share link, the GPC signal, the data-request route and whether the privacy policy matches the site’s behavior.
Does it apply outside California?
Several other states have similar laws. CyRisk tracks opt-out and broker obligations under them too, such as Colorado’s and Connecticut’s.
Find out who honors the opt-out.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.