What the CCPA, CPRA, and neighboring California laws require, explained in plain language with the statute cited.
9 articles, newest first
No CCPA provision requires a cookie consent banner. California asks for a notice at collection, a working opt-out link, and honored opt-out signals. Here is what that means for your site, and when a banner still helps.
Connecticut's second round of Data Privacy Act amendments takes effect October 1, 2026. Selling precise geolocation data is banned, purpose limitation tightens, and data brokers must register. Here is what changes on your website.
Governor Newsom signed AB 883 and AB 2561 on September 27, 2026. Data brokers get 30 days instead of 45 to work DROP deletion requests, and apps and operating systems can no longer quietly reset a privacy setting a user turned on. Both take effect January 1, 2027.
Governor Newsom signed SB 923 on September 27, 2026. From January 1, 2027, a CCPA deletion request reaches personal information a business got from third parties, and online-only businesses must offer a web form for privacy requests, not just an email address.
CIPA is a plaintiff risk, not a regulator risk, and the claims are built from what your site loads before a visitor makes any consent choice. Here are the two theories, the statutory damages arithmetic, and where the courts currently disagree.
Updated
Honoring the GPC signal does not retire the Do Not Sell or Share link, and posting the link does not excuse ignoring the signal. They sit in different sections and serve different visitors. Here is what each covers, and where the one narrow exception sits.
The provisions these articles turn on, with the text and a plain-language summary of each.
Put it to work
The free check sends a real GPC signal to one URL and shows whether marketing trackers stop. The full audit runs free from our homepage with no account; paying unlocks its evidence.