Ignored Global Privacy Control signals while sharing data with ad-tech partners.
CCPA / CPRA + US state laws
California runs on opt-out. So does UserGuard.
The CCPA doesn’t ask for an “Accept cookies” wall. It asks for honest notice, a working “Do Not Sell or Share” mechanism, and automatic honoring of Global Privacy Control. That’s exactly the machinery UserGuard is built to run.
What California requires
The obligations, plainly.
Businesses in scope must tell visitors what they collect and why, give them a real way out of the sale and sharing of their personal information (“sharing” includes routine ad-tech pixels), and treat a browser’s Global Privacy Control signal as a valid opt-out. Honoring GPC isn’t a nice-to-have; it’s mandatory, and it’s where California’s biggest enforcement actions have landed.
A business that honors opt-out signals frictionlessly may even rely on that in place of posting the link. That is a genuine advantage of getting GPC right.
The enforcement ledger
Real cases. Real numbers.
California regulators fine the mechanics: ignored signals, opt-outs that don’t propagate, misconfigured banners. These are the failure modes UserGuard is designed around.
Opt-out flows that made saying “no” harder than saying “yes.”
Kept sharing data with ad partners after visitors opted out — the largest CCPA settlement to date.
Opt-out requests went unprocessed for 40 days, then the form demanded ID before it would honor one. The regulator’s message: an opt-out you make people prove themselves for is not an opt-out.
Automatic GPC honoring
Designed to detect the Global Privacy Control signal and apply the opt-out automatically. No clicks required, logged like everything else.
Opt-out that propagates — as far as a browser can reach
The opt-out gates the tags on your pages and publishes the USP string vendors read. It cannot reach server-to-server conversion APIs, CRM syncs, audience uploads or data you sell directly. Those stay yours to switch off, and pretending otherwise is the failure mode behind California’s largest settlements.
The state patchwork, handled
19+ state laws in force in 2026, twelve requiring universal opt-out signals. Region-aware behavior shows each visitor what their state calls for.
Honest answers
CCPA questions, answered
Does the CCPA require a cookie banner?
No. California runs on an opt-out model: businesses in scope must give notice at collection, offer a “Do Not Sell or Share My Personal Information” mechanism, and honor Global Privacy Control signals. An EU-style “Accept cookies” gate is not what the law asks for, and implying tracking is blocked until “Accept” while pixels fire anyway creates its own deception risk.
What is Global Privacy Control (GPC)?
GPC is a browser signal that communicates a visitor’s opt-out preference automatically. Honoring it is mandatory under CCPA/CPRA, and as of 2026, twelve US states require honoring universal opt-out signals like GPC. UserGuard is designed to detect GPC and apply the opt-out without the visitor clicking anything.
Which US states have privacy laws in 2026?
Nineteen-plus comprehensive state privacy laws are in force as of 2026: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and more, with Indiana, Kentucky, and Rhode Island effective January 2026. Most follow an opt-out model for targeted advertising with opt-in consent for sensitive data. UserGuard applies region-aware behavior so each visitor sees what their state’s law calls for.
Does UserGuard make my site CCPA compliant?
No tool can. Compliance depends on your data practices, contracts, policies, and configuration. UserGuard operationalizes the visitor-facing mechanics: notice, the opt-out link, GPC honoring, and records of opt-out status, as part of your broader compliance program.
This page is general information about privacy laws, not legal advice. UserGuard helps you operate consent and opt-out management as part of your compliance program. Configuration decisions and legal outcomes remain yours. Consult qualified counsel for your situation.
