The CCPA does not ban marketing. It sets rules for how you collect, use, sell and share the personal information of California residents, and it gives those people rights you have to honor. For marketers, that comes down to four jobs: tell people what you collect, let them opt out of sale or sharing (including through a browser signal), respond to access and deletion requests, and keep your vendors on a short contractual leash.
This guide walks through what that means for ads, email, analytics, CRM and lead generation, and ends with a checklist you can hand to your team. It is general information, not legal advice. For decisions about your own exposure, talk to a privacy attorney.
TL;DR
- The CCPA applies to for-profit businesses that do business in California and meet a revenue or data-volume threshold. Check the thresholds before assuming you are in or out.
- Marketers must support the rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information.
- Opt-out preference signals such as Global Privacy Control must be treated as valid opt-out requests, and regulators are actively testing for this.
- Cookie banners, pixels and ad platforms count: configure them to respect choices, and never design an interface that makes opting out confusing.
- Review contracts with every vendor that touches customer data, then document how you handle requests.
Table of Contents
- Does the CCPA apply to your business?
- What counts as personal information in marketing
- The consumer rights your marketing has to support
- Notices: what to say and when
- Consent versus opt-out: what the CCPA actually asks
- Cookies, pixels and the Global Privacy Control
- Vendors, platforms and your CRM
- A CCPA marketing compliance checklist
- Our perspective at Magic Logix
- Where Magic Logix can help
- FAQ
- Sources
Does the CCPA apply to your business?
The law covers for-profit businesses that do business in California, collect personal information and decide why and how it is processed. Beyond that, you must meet at least one threshold. According to the California Privacy Protection Agency, those are:
- prior-year gross revenue over $26,625,000;
- buying, selling or sharing the personal information of 100,000 or more consumers or households;
- earning 50% or more of annual revenue from selling or sharing personal information.
The revenue figure started at $25 million in the statute, as the California Attorney General’s CCPA page still describes it. The agency’s guidance gives the adjusted amount, so use the agency’s current figure when you check.
Two points surprise smaller teams. First, the 100,000 threshold counts consumers or households, and a busy website with advertising pixels can reach it faster than you would guess. Second, you do not need an office in California. If you do business there and meet a threshold, your marketing is in scope.
If you fall below every threshold, you may still want to follow the same practices. Other states have passed their own privacy laws, and customers in general respond well to clear choices. Our privacy-first marketing guide for US teams covers that wider view.
What counts as personal information in marketing
The definition is broad. Under California Civil Code section 1798.140, personal information is data that identifies, relates to, describes or could reasonably be linked to a consumer or household. The statute names identifiers, commercial information, internet activity and geolocation data among the examples.
In marketing terms, that reaches most of your stack:
| Marketing data | Why it is likely in scope |
|---|---|
| Email address, phone number, postal address | Direct identifiers |
| Cookie IDs, mobile ad IDs, IP address | Online identifiers linked to a device or person |
| Browsing and click history, form fills | Internet activity |
| Purchase history, abandoned carts | Commercial information |
| Location from apps or ad targeting | Geolocation data |
| Inferences used to build audiences or scores | Information reasonably associated with a consumer |
A subset is treated more strictly. The California Privacy Protection Agency FAQ describes sensitive personal information as including government identifiers, financial account access, precise geolocation, contents of communications, genetic data, biometric information, health data, and information about race, religion or sexual orientation. If your campaigns segment on any of these, slow down and get legal review first.
The consumer rights your marketing has to support
The Attorney General’s CCPA page lists the rights marketers need to be able to honor:
- Right to know and access: a consumer can ask what personal information you collect about them.
- Right to delete: subject to certain exceptions.
- Right to correct: inaccurate information must be fixable.
- Right to opt out of sale or sharing: the one that most affects advertising.
- Right to limit the use and disclosure of sensitive personal information.
In practice, each right touches a different system. A deletion request has to reach your email platform, CRM, ad audiences and any data warehouse. An opt-out has to stop your pixels and audience uploads. If the request only removes someone from one tool, you have not complied.
How rights affect lead generation
Expect some friction in your numbers. Opted-out users shrink your retargeting pools and lookalike seeds. That is the point of the law, and it is a reason to invest in data you collect directly with permission. Our explainer on first-party data and how to use it shows where to start. Teams with solid first-party lists usually feel opt-outs less.
Notices: what to say and when
Businesses must give consumers notices explaining their privacy practices, and tell them at or before the point of collection what categories of personal information are collected and what the business may do with them, per the Attorney General. Think of it as the label on the jar: it must be there before the jar is opened.
For marketers, that means checking every place you collect data:
- website forms and newsletter signups;
- gated content and webinar registration;
- chat widgets and quote requests;
- landing pages built for campaigns, which are often launched without privacy review;
- mobile app screens and in-store or event signups.
Each needs a notice at collection or a clear link to one. Keep the language plain. The FTC has stressed that transparent privacy interfaces help build customer trust and encourages policies consumers can actually understand, in a research paper published on its site.
Also keep your promises. FTC staff have long advised that companies must adhere to their stated privacy promises and cannot make material changes to how they collect or use data without consumer consent, as laid out in the FTC’s staff report on online behavioral advertising. If your team quietly adds a new ad partner, check that your notice still tells the truth.
Consent versus opt-out: what the CCPA actually asks
The query “CCPA consent requirements” has a short answer. The CCPA is mainly an opt-out law for sale and sharing. You can generally collect and use data for disclosed purposes, provided you give notice and a working way to say no. It is not the pre-consent model many marketers know from European rules.
Three details keep that from being a free pass:
- After an opt-out, you need new authorization to resume. Once a consumer opts out, you cannot sell or share their information unless they later authorize it, and you must wait at least 12 months before asking them to opt back in (Attorney General). Build that waiting period into your remarketing and win-back flows.
- Sensitive data has its own limit right. Consumers can restrict how sensitive personal information is used and disclosed.
- Other regulators apply stricter standards. The FTC’s proposed order against an addiction treatment company banned sharing health data for advertising and required affirmative consent before sharing it for any other purpose, as announced in its April 2024 press release. That is an FTC action, not a CCPA rule, but it shows how health-related targeting is judged.
The practical rule: use opt-out as your legal baseline for ordinary marketing, and use opt-in for anything sensitive, anything surprising and anything you would not want to explain on a call with a regulator.
Cookies, pixels and the Global Privacy Control
This is where most marketing exposure sits. The CCPA’s concept of “sharing” captures many cross-context behavioral advertising setups, so the tags on your site matter.
The opt-out link
Businesses must provide clear and conspicuous links, such as “Do Not Sell or Share My Personal Information” or “Your Privacy Choices,” typically at the bottom of a webpage, according to California’s privacy.ca.gov guidance. Test the link on mobile, and confirm that clicking it changes what your tags do, not just what the page says.
Honoring opt-out preference signals
Businesses must also honor user-enabled opt-out preference signals such as the Global Privacy Control (GPC), which communicate a request to opt out of sale or sharing, per the same privacy.ca.gov guidance. The Attorney General confirms that GPC counts as a valid, automated opt-out request.
Here is a simple test your team can run this week:
- Open a browser with GPC enabled.
- Visit your site and a few campaign landing pages.
- Check your network requests and tag manager to see whether advertising pixels and audience-sharing tags still fire.
- Fix what still fires, then retest on mobile.
Clean opt-out handling also protects your reporting. When blocked or unwanted traffic pollutes your conversion data, ad platforms learn from the wrong people, which is why we point teams toward practical ways to filter spam leads in layers alongside privacy controls.
Do not make the opt-out hard
An interface that confuses people is a risk of its own. The state’s final judgment against a mobile game company addressed cookie preference managers and data collection tools that were set up in ways that undercut the opt-out process. Avoid dark patterns: no buried toggles, no “accept” buttons that are bigger and brighter than the alternative, no wording that makes opting out sound like losing something.
Enforcement is active
Regulators are testing this. The Attorney General announced a joint investigative privacy sweep with Colorado and Connecticut aimed at businesses that appear not to honor GPC opt-out requests, asking them to come into compliance. A site that ignores the signal is easy to find with automated checks.
Vendors, platforms and your CRM
Your compliance is only as good as your weakest vendor. Under the CCPA statute as effective January 1, 2026, contracts with service providers and contractors must restrict data use to specified purposes and prohibit further disclosure. When you use advertising platforms, tracking technologies must be configured to respect privacy choices, and designs must not subvert opt-outs.
Walk through each category:
| Vendor type | What to check |
|---|---|
| CRM and email platform | Contract limits on use, deletion workflow, how opt-outs sync |
| Ad platforms and pixels | Settings that restrict data use for opted-out users |
| Analytics tools | What identifiers are collected and whether they are shared for ads |
| Lead providers and list vendors | Where the data came from and what notice people saw |
| Agencies and freelancers | Written limits on use of your customer data |
A clean CRM setup makes all of this easier. If every lead has a source, a consent or notice record and a status field for opt-outs, requests become a lookup instead of a scramble. Our guide to CRM marketing integration explains how to map leads before choosing tools, and our retargeting checklist with privacy controls covers the ad side.
A CCPA marketing compliance checklist
Use this as a quarterly review. Assign an owner to every line.
Inventory
- List every tool, tag, pixel and vendor that touches customer data.
- Note which ones send data to third parties for advertising.
- Record where each form and landing page collects information.
Notices and links
- Confirm a notice at collection on every form and campaign page.
- Confirm the opt-out link appears and works on desktop and mobile.
- Match the privacy policy to what the tags actually do.
Signals and requests
- Test GPC on key pages and fix any tags that still fire.
- Set up one intake path for know, delete, correct and limit requests.
- Make sure each request reaches the email platform, CRM, audiences and warehouse.
- Log the 12-month wait before re-asking an opted-out consumer.
Vendors
- Review contracts for purpose limits and no further disclosure.
- Ask lead providers how they obtained consent or provided notice.
Measurement
- Track the opt-out rate, request volume and time to complete a request.
- Compare conversion rates before and after tag changes, so you know the real cost of compliance and can plan around it.
Decide in advance who can pause a campaign when something fails. A named person with that authority is worth more than a long policy document.
Our perspective at Magic Logix
Most privacy problems we see in marketing are not legal puzzles. They are operations problems: a tag added for a campaign and never reviewed, a form built without a notice, a deletion request that reaches one system and not the rest. We think of privacy as plumbing. When the pipes are mapped and labeled, you can add a new fixture without flooding the kitchen.
That is why we favor first-party data, simple consent language and a tidy tag setup over clever workarounds. It also fits how we describe our approach, Digital Beyond Tomorrow: build marketing that still works when rules and platforms change. We would rather help a team measure honestly with fewer signals than depend on tracking that a regulator can switch off.
One caution applies to everything above. Privacy rules and enforcement priorities are changing, and the thresholds are adjusted over time. Check the official pages linked here before you act, and bring in counsel for your specific data and industry.
— Hassan Bawab
Where Magic Logix can help
If your team needs to rebuild forms, consent flows or landing pages so privacy choices work from the first click, our website design and development team can help. For paid media and analytics that respect opt-outs, see our digital marketing and paid media services, or start a conversation with Magic Logix about where your stack stands today.
FAQ
Does the CCPA apply to small businesses?
Only if they do business in California, collect personal information and meet one of the thresholds: revenue above the adjusted dollar figure, handling data of 100,000 or more consumers or households, or earning half of revenue from selling or sharing data. Many small companies fall under all three. Check the agency’s guidance and confirm with counsel.
Do I need a cookie banner for the CCPA?
The CCPA requires a working opt-out of sale or sharing, a clear link and respect for signals like GPC. A banner is one way to deliver that, but it must not confuse people or make opting out harder than opting in. If your site shares data for advertising, your tags need to change behavior when someone opts out.
Do I have to honor Global Privacy Control?
Yes. California treats GPC as a valid, automated request to opt out of sale or sharing, and regulators have run sweeps looking for sites that ignore it. Test with GPC enabled and fix any advertising tags that still fire.
Can I email someone again after they opt out?
An opt-out covers sale and sharing of personal information, not every email you send. But you cannot sell or share their data unless they later authorize it, and you must wait at least 12 months before asking them to opt back in. Keep opt-out status in your CRM so campaigns respect it.
Sources
- California Consumer Privacy Act (CCPA), State of California Department of Justice
- Does My Business Need To Comply With The CCPA, California Privacy Protection Agency
- California Civil Code section 1798.140
- Frequently Asked Questions, California Privacy Protection Agency
- LOCKED Series: Right to Limit and Opt-Out, privacy.ca.gov
- CCPA statute effective January 1, 2026
- Final Judgment and Permanent Injunction, People v. Jam City
- Attorney General Bonta announces joint investigative privacy sweep
- FTC press release on health data and advertising, April 2024
- FTC staff report on online behavioral advertising, 2009
- Notice and Choice Framework for Fostering Marketer Trustworthiness, FTC
- Filter spam leads in layers
