Ignored Global Privacy Control signals while sharing data with ad-tech partners.
CCPA / CPRA + US state laws
California works on opt-out, and UserGuard can run it.
The CCPA doesn’t ask for an “Accept cookies” wall. It asks you to give clear notice, offer a working “Do Not Sell or Share” mechanism, and honor Global Privacy Control automatically. UserGuard is built to run those pieces for you.
What California requires
What businesses in scope have to do.
If you’re in scope, you have to tell visitors what you collect and why, give them a working way to opt out of the sale and sharing of their personal information (“sharing” includes routine ad-tech pixels), and treat a browser’s Global Privacy Control signal as a valid opt-out. Honoring GPC is mandatory, and it has come up in several California enforcement actions.
A business that honors opt-out signals frictionlessly may even rely on that in place of posting the link, which is a good reason to get GPC right.
Enforcement
Four California enforcement cases.
California regulators fine companies for how the mechanics work: ignored signals, opt-outs that don’t propagate, misconfigured banners. We designed UserGuard with these failures in mind.
Opt-out flows that made saying “no” harder than saying “yes.”
Kept sharing data with ad partners after visitors opted out. It was the largest CCPA settlement at the time.
Opt-out requests went unprocessed for 40 days, then the form demanded ID before it would honor one. The regulator’s message was that you can’t make people prove who they are just to opt out.
Automatic GPC honoring
UserGuard is designed to detect the Global Privacy Control signal and apply the opt-out automatically. The visitor doesn’t have to click anything, and we log it like every other choice.
An opt-out that reaches as far as a browser can
The opt-out holds the tags on your pages and publishes the USP string vendors read. It can’t reach server-to-server conversion APIs, CRM syncs, audience uploads or data you sell directly. You have to switch those off yourself, and assuming the banner takes care of them is what went wrong in several California settlements.
US state laws
There are 19+ state laws in force in 2026, and twelve of them require universal opt-out signals. GPC is honored automatically on every site, so that opt-out happens without a click.
FAQ
CCPA questions, answered
Does the CCPA require a cookie banner?
No. California runs on an opt-out model: businesses in scope must give notice at collection, offer a “Do Not Sell or Share My Personal Information” mechanism, and honor Global Privacy Control signals. An EU-style “Accept cookies” gate is not what the law asks for, and implying tracking is blocked until “Accept” while pixels fire anyway creates its own deception risk.
What is Global Privacy Control (GPC)?
GPC is a browser signal that communicates a visitor’s opt-out preference automatically. Honoring it is mandatory under CCPA/CPRA, and as of 2026, twelve US states require honoring universal opt-out signals like GPC. UserGuard is designed to detect GPC and apply the opt-out without the visitor clicking anything.
Which US states have privacy laws in 2026?
Nineteen-plus comprehensive state privacy laws are in force as of 2026: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and more, with Indiana, Kentucky, and Rhode Island effective January 2026. Most follow an opt-out model for targeted advertising with opt-in consent for sensitive data. UserGuard honors GPC automatically for every US visitor. The banner adapts by country, not yet by state, so every US visitor gets the consent model you set. Choose the one your strictest state needs.
Does UserGuard make my site CCPA compliant?
No tool can. Compliance depends on your data practices, contracts, policies, and configuration. UserGuard runs the visitor-facing mechanics: notice, the opt-out link, GPC honoring, and records of opt-out status, as part of your broader compliance program.
This page is general information about privacy laws, not legal advice. UserGuard helps you operate consent and opt-out management as part of your compliance program. Configuration decisions and legal outcomes remain yours. Consult qualified counsel for your situation.
