The California Consumer Privacy Act is among the most influential privacy laws in the United States. Given that many major tech companies are headquartered in California, the CCPA has an outsized impact on the digital economy.

What the CCPA Covers

The CCPA grants California residents specific privacy rights and applies to large businesses or those controlling substantial amounts of personal information, including organizations outside California and even outside the US. Government agencies and nonprofits are generally exempt.

Personal information under the CCPA is defined broadly: any information that can reasonably be linked to a particular consumer or household, including unique identifiers found in cookies.

Impact on Cookies and Web Analytics

Although the CCPA has no cookie-specific rules, its provisions on third-party data sharing directly affect web analytics. Sharing personal information with analytics or advertising providers can constitute a "sale" under the Act, triggering the right to opt out. Businesses must provide information pop-ups and conspicuous opt-out options. Opt-in consent is required before selling personal data of minors under 16. Businesses must also honor Global Privacy Control (GPC) signals from browsers.

The Sephora enforcement case illustrates these obligations. The cosmetics retailer settled for $1.2 million after failing to disclose data sharing with an analytics provider, failing to honor opt-out requests, and not curing violations within the allowed timeframe. Notably, the company was not selling data to brokers -- routine web marketing and analytics activities triggered the violation.

Direct Marketing Implications

While the CCPA does not specifically regulate direct marketing, its data-sharing rules restrict the availability of third-party data for marketing purposes. Additional legislation like the Delete Act will further limit data availability for companies relying on third-party data enrichment.

Sensitive Information Protections

Consumers can limit the use and disclosure of sensitive information -- including precise geolocation, genetic data, sexual orientation, and financial identifiers -- to what is strictly necessary for providing requested services.

The Broader US Privacy Landscape

The CCPA exists within a fragmented regulatory environment. Without comprehensive federal privacy legislation, states have enacted their own laws, creating compliance complexity for businesses operating nationally. Whether proposed federal legislation like ADPPA will preempt or complement state laws remains an open question.