What the CCPA, CPRA, and neighboring California laws require, explained in plain language with the statute cited.
5 articles, newest first
CIPA is a plaintiff risk, not a regulator risk, and the claims are built from what your site loads before a visitor makes any consent choice. Here are the two theories, the statutory damages arithmetic, and where the courts currently disagree.
Updated
Honoring the GPC signal does not retire the Do Not Sell or Share link, and posting the link does not excuse ignoring the signal. They sit in different sections and serve different visitors. Here is what each covers, and where the one narrow exception sits.
California is the loudest, not the only one. Colorado, Connecticut, Texas, and Vermont each fold a universal opt-out mechanism into their own statutes, on their own dates and in their own words. Virginia is the instructive exception.
The California Attorney General has stepped up enforcement. Here's what the 2026 updates mean for your business and how to prepare.
Updated
The CPRA updated dark pattern rules in 2026. Learn what the symmetry requirement means for your cookie banner.
The provisions these articles turn on, with the text and a plain-language summary of each.
Put it to work
The free check sends a real GPC signal to one URL and shows whether marketing trackers stop. Claim the result into a free account and your first full audit is included.