CCPA and CPRA for ecommerce: what California privacy law requires

The California Consumer Privacy Act went into effect in 2020. The California Privacy Rights Act amended and strengthened it, with most new provisions operative from January 2023. Together they form the most comprehensive consumer privacy framework in the United States, and they apply to a large share of mid-market ecommerce stores.

Enforcement has accelerated. The California Privacy Protection Agency, created by CPRA, issued its first formal enforcement actions in 2025 and has signaled it will prioritize ecommerce companies that collect significant amounts of consumer data. Fines run to $2,500 per unintentional violation and $7,500 per intentional violation. With millions of site visitors, the math becomes uncomfortable quickly.

Who is in scope

CCPA and CPRA apply to for-profit businesses that do business in California and meet at least one of three thresholds:

• Annual gross revenues above $25 million.
• Annually buy, sell or share the personal information of 100,000 or more consumers or households.
• Derive 50% or more of annual revenues from selling or sharing consumers' personal information.

The second threshold is the one most mid-market ecommerce stores hit. A store with 100,000 unique visitors per year, where each visit sets an analytics cookie or logs an IP address, has collected personal information from 100,000 consumers. At typical ecommerce traffic levels, this threshold is easier to reach than most operators realize.

You do not need to be headquartered in California. You do not need to have a California office. If you have California customers and meet one of those thresholds, you are subject to the law.

Key consumer rights

The law grants California residents a set of rights that in-scope businesses must honor. Ecommerce stores need operational processes to fulfill each one.

Right to know

Consumers can request disclosure of what personal information a business has collected about them, the categories of sources it came from, the business purpose for collecting it and the third parties it was shared with. Businesses have 45 days to respond, extendable by another 45 days with notice.

For ecommerce stores this typically means pulling together purchase history, browsing data, email marketing preferences, customer service records and any data shared with advertising platforms. The response must cover the preceding 12 months.

Right to delete

Consumers can request deletion of their personal information. Businesses must delete it and direct their service providers to delete it as well. Exceptions exist: data needed to complete a transaction, detect fraud, meet legal obligations or fulfill a warranty.

This has real operational implications. Deleting a customer record from your ecommerce platform is straightforward. Ensuring that record is also deleted from your email marketing tool, your analytics platform, your CRM, your ad retargeting lists and your data warehouse is considerably more complex.

Right to correct

CPRA added this right, which CCPA did not include. Consumers can request correction of inaccurate personal information. Businesses must use commercially reasonable efforts to correct it, considering the nature of the information and the purposes of processing.

Right to opt out of sale or sharing

This is the right most consequential for ecommerce advertising. Under CPRA, "sharing" was added alongside "sale" to capture behavioral advertising even when no money changes hands. When you send customer data to Meta or Google for ad targeting, that is sharing under the law.

Consumers have the right to opt out of this. Businesses must provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on their homepage. Many stores buried this in the footer or privacy policy. The CPPA has specifically called out inadequate disclosure as an enforcement priority.

Right to limit use of sensitive personal information

CPRA created a new category of sensitive personal information and gives consumers the right to limit its use to what is necessary to perform the services requested. For ecommerce, sensitive personal information includes precise geolocation data, health and medical information and account credentials. Stores that collect any of these need a separate "Limit the Use of My Sensitive Personal Information" link. If your store collects data from children under 13, federal COPPA requirements impose additional obligations on top of CCPA.

Right to data portability

Consumers can request their data in a portable format, suitable for transmission to another entity. The format must be usable and technically feasible to transmit.

Global Privacy Control compliance

The Global Privacy Control is a browser-level signal that tells websites a user wants to opt out of the sale and sharing of their personal information. The California Attorney General confirmed in 2022 that businesses must honor GPC signals. The CPPA has reinforced this position in subsequent guidance.

In practice, this means your store needs to detect when a visitor's browser sends a GPC signal and automatically suppress ad tracking and data sharing for that visitor. This is a technical requirement, not just a UI requirement. A "Do Not Sell" link is not sufficient if you are not also honoring GPC.

The CPPA fined Sephora $1.2 million in 2022 partly because it failed to honor GPC signals while continuing to share customer data with advertising networks. The action sent a clear message about GPC enforcement seriousness.

Cookie and tracking implications

Unlike GDPR, CCPA and CPRA do not require opt-in consent for cookies in most cases. The focus is on the right to opt out of sale and sharing. But the practical implementation overlaps significantly with cookie consent.

Third-party advertising cookies, Meta Pixel, Google Ads conversion tracking and similar technologies transfer consumer data to third parties for behavioral advertising. Under CPRA, this constitutes sharing. If a California consumer visits your store and you fire a Meta Pixel that sends their browsing behavior to Meta for ad targeting, that sharing has occurred before any opt-out opportunity.

Some stores implement a California-specific experience that delays ad tech scripts until after consent is obtained or opt-out is confirmed. Others treat all visitors as California residents for simplicity. The latter approach is more defensible.

Service provider agreements

CCPA and CPRA require that personal information shared with service providers is covered by a written contract specifying that the service provider will only use the data to perform the contracted services and not for its own commercial purposes.

For ecommerce stores this means auditing your vendor relationships. Your email marketing platform, your analytics tool, your fulfillment partner and your customer service software all handle personal information. Each relationship needs a data processing agreement (DPA) or equivalent contract language confirming their service provider status.

If a service provider uses your customers' data for their own purposes, such as building their own advertising audiences, they may be a "third party" under the law rather than a service provider. Sharing with a third party triggers the opt-out requirement.

CPPA enforcement in 2025 and 2026

The California Privacy Protection Agency began formal enforcement in 2025 after the California Supreme Court resolved a dispute about the enforcement timeline. Initial actions focused on systemic violations at large companies, but the CPPA has made clear that mid-market ecommerce is a priority sector.

The CPPA's enforcement approach includes:

• Automated scanning of websites for missing opt-out links and GPC non-compliance.
• Consumer complaint processing, with complaints routable directly to the agency.
• Audits triggered by pattern analysis of businesses in specific sectors.

The $7,500 per intentional violation figure is significant. Intentional does not require malicious intent. A business that knows the law applies to it and has not implemented required disclosures or opt-out mechanisms can face intentional violation findings.

The CPPA has also begun cooperating with other state privacy enforcement agencies. A violation of California law often maps to violations of Virginia's VCDPA, Colorado's CPA and similar statutes. A single enforcement investigation can cascade.

How CCPA and CPRA compare to GDPR

The fundamental difference is the legal basis for data processing. GDPR requires a lawful basis for every processing activity. The default for advertising is consent, which must be affirmative and prior. CCPA takes an opt-out approach: processing can happen, but consumers must be given a real opportunity to stop it.

This makes GDPR compliance generally more demanding operationally. A store compliant with GDPR's consent requirements for advertising will satisfy most CCPA and CPRA obligations in that area almost automatically. The reverse is not true.

CPRA introduced data minimization principles and purpose limitation that move closer to the GDPR model. Businesses must not collect personal information beyond what is necessary and must not use it for purposes incompatible with the original collection purpose. CPRA also added explicit provisions targeting dark patterns that make it harder for consumers to exercise their privacy rights. These principles will become more prominent in future enforcement.

Practical compliance steps for ecommerce stores

• Determine if you are in scope. Check your revenue and count unique visitors or consumers you have data on. If you are close to any threshold, assume you are in scope.
• Audit your data flows. Map what personal information you collect, where it goes and what vendors handle it. Include ad tech platforms, analytics and marketing automation.
• Add required links. Place a "Do Not Sell or Share My Personal Information" link on your homepage. Add "Limit the Use of My Sensitive Personal Information" if applicable. Both must be clear and conspicuous.
• Honor GPC signals technically. Implement server-side or client-side detection of GPC headers and suppress ad tracking accordingly.
• Update your privacy policy. CCPA and CPRA specify what must be disclosed: categories of data collected, sources, business purposes, third parties and consumer rights with instructions for exercising them.
• Build request fulfillment processes. You need a mechanism to receive, verify and respond to consumer requests within 45 days. Verification must confirm the requester is who they claim to be without being overly burdensome.
• Sign DPAs with vendors. Review contracts with every vendor that handles personal information. Ensure service provider language is in place.
• Train your team. Staff who handle customer data or respond to customer inquiries need to understand consumer rights and how to direct requests appropriately.
• Review email marketing practices. Marketing emails to California consumers must respect opt-out preferences. Our guide on email marketing compliance covers CAN-SPAM and CCPA requirements for commercial communications.

The broader US privacy landscape

California set the template. As of late 2026, 19 other states have enacted comprehensive consumer privacy laws. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others have statutes with broadly similar rights and obligations.

A federal privacy law remains stalled in Congress. In the absence of federal preemption, the state-by-state patchwork will continue to expand. Ecommerce stores with national customer bases effectively face a nationwide compliance requirement, with California's standard as the most demanding benchmark.

Building CCPA and CPRA compliance now creates a foundation for compliance with other state laws. The core requirements, consumer rights, opt-out mechanisms, service provider agreements and data minimization, appear across nearly all state frameworks with variations in scope thresholds and enforcement mechanisms.

Frequently asked questions

Does CCPA apply to my ecommerce store?

CCPA applies if you do business in California and meet one of three thresholds: over $25 million annual revenue, buy or sell data of 100,000+ consumers annually, or derive 50%+ of revenue from selling personal information. Most mid-market stores hit the second threshold through analytics cookies and IP addresses alone.

What is the difference between CCPA and CPRA?

CPRA amended and strengthened CCPA, adding the right to correct data, the right to limit sensitive data use and a new enforcement agency (CPPA). CPRA also expanded the definition of sharing to cover behavioral advertising even when no money changes hands.

Do I have to honor Global Privacy Control signals under CCPA?

Yes. The California Attorney General and the CPPA have confirmed that businesses must treat GPC browser signals as valid opt-out requests for the sale and sharing of personal information. Sephora was fined $1.2 million partly for failing to honor GPC.

What are CCPA fines for ecommerce stores?

Fines are $2,500 per unintentional violation and $7,500 per intentional violation. Each affected consumer record counts as a separate violation, so fines scale quickly with traffic volume.