Industries · E-commerce
Under California law, sharing personal information for cross-context advertising counts whether or not money changes hands. That’s why a store running ordinary remarketing pixels usually owes Californians a working opt-out, and several big CCPA settlements have been about opt-outs that didn’t work.
The fall gear list
After the opt-out
The short answer
California doesn’t ask for an “Accept cookies” wall. It asks for notice at collection, a working “Do Not Sell or Share My Personal Information” mechanism, and automatic honoring of the Global Privacy Control signal. The regulations are explicit that a cookie control is not by itself an acceptable opt-out method, which is why UserGuard ships Do Not Sell as its own mechanism with its own link, panel and record.
A browser-side opt-out holds the tags on your pages and publishes the USP string vendors read. It can’t reach server-to-server conversion APIs, CRM syncs, audience uploads or data you sell directly, so you have to switch those off yourself. Assuming the banner takes care of them is what went wrong in several California settlements.
What a storefront usually sets
For Meta, Google Ads, TikTok, Pinterest, Bing and LinkedIn, the default blocking rules name both the loader scripts and the beacon endpoints they call, because holding a script host doesn’t do much if a hand-placed image pixel fires anyway. First match wins, and you can edit the rule list.
Remarketing is the clearest case of cross-context behavioral advertising, and it’s what an opt-out is for. UserGuard treats analytics and marketing as sale categories by default, and a store that doesn’t pass analytics data on can take that one out.
Storefront platforms and their apps add cookies you never chose, from reviews widgets, upsell apps, live chat and loyalty tools. Any new install can add more, which is why scans run monthly and a manual rescan after any change takes one click.
Since March 2024, Consent Mode v2 has been required for Google advertising and measurement features covering EEA and UK users. UserGuard sets default-denied signals for all four consent types before any Google tag loads, then updates them the moment a visitor chooses, so campaigns scale back instead of firing without consent.
Enforcement
It’s the ignored signal, the opt-out that didn’t propagate and the request that went unprocessed, more than the design of the banner.
Ignored Global Privacy Control signals while sharing data with ad-tech partners.
Opt-out flows that made saying “no” harder than saying “yes.”
Kept sharing data with ad partners after visitors opted out. It was the largest CCPA settlement at the time.
Opt-out requests went unprocessed for 40 days, then the form demanded ID before it would honor one.
Coverage
It gets its own link, panel and record, with a 365-day lifetime and automatic GPC honoring.
See how → GDPR + ePrivacyNon-essential tags are held until consent, with Consent Mode v2 signals for Google campaigns.
See how → WCAG 2.1 AA · ADA · EAAThe European Accessibility Act covers consumer-facing e-commerce, benchmarked by EN 301 549.
See how →This page is general information about privacy laws, not legal advice. Whether your store is in scope, and which categories count as a sale or share for your business, depend on facts we cannot see from here. Consult qualified counsel for your situation.
Start today
Create an account, add one line of code, and the first scan runs in minutes. If it isn’t right, you have thirty days to get your money back.
