CCPA opt-out banner for WordPress

The CCPA (as amended by the CPRA) works differently from Europe’s GDPR. Most cookies can run before a visitor chooses, but the visitor must be able to say no to the sale or sharing of their personal information. “Sharing” means cross-context behavioral advertising, which is what ad pixels such as the Meta Pixel, TikTok and Google Ads remarketing are used for.

That is why a California banner is about the opt-out: it tells visitors what happens and gives them a real way to stop it.

The regulations require a conspicuous “Do Not Sell or Share My Personal Information” link in the header or footer of your homepage (11 CCR § 7013). Instead, you may use the alternative opt-out link, titled “Your Privacy Choices” or “Your California Privacy Choices”, with the state’s opt-out icon next to it, sized like the other icons in your header or footer (11 CCR § 7015).

The link must lead to a page or panel where the visitor can opt out, with a Notice of Right to Opt-out of Sale/Sharing explaining the right and how to use it.

If a visitor’s browser sends a Global Privacy Control signal, a business that sells or shares personal information must treat it as a valid request to opt out, for that browser and for any profile tied to it, and for the person’s account if they are signed in (11 CCR § 7025). Since the updated regulations took effect on January 1, 2026, the business must also show on its site whether it processed the signal, for example “Opt-Out Preference Signal Honored” or a switch showing the visitor is opted out.

In August 2022 California’s Attorney General announced a $1.2 million settlement with Sephora, which had not disclosed that it sold personal information and had not processed opt-outs sent through Global Privacy Control.

Opt-outs also cover information you hold outside the browser, such as email lists and form leads. A business may not require a verifiable request to opt out. It must stop selling or sharing as soon as feasibly possible and no later than 15 business days after receiving the request, and tell the third parties it sold or shared the information with (11 CCR § 7026). Records of requests and how you answered them are kept for at least 24 months (11 CCR § 7101).

The CCPA covers for-profit businesses that meet one of its thresholds, such as annual revenue above the limit or handling the personal information of 100,000 or more California residents. See the CCPA page for the current thresholds. Many smaller sites follow the same rules because other states, and their advertising partners, expect them.