{"id":18518,"date":"2026-04-24T17:52:12","date_gmt":"2026-04-24T15:52:12","guid":{"rendered":"https:\/\/stage.usercentrics.com\/us\/?post_type=knowledge&#038;p=18518"},"modified":"2026-04-24T18:58:43","modified_gmt":"2026-04-24T16:58:43","slug":"ccpa-cookie-banner","status":"publish","type":"knowledge","link":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/","title":{"rendered":"CCPA Cookie Banner Requirements: Steps for Compliance in 2026"},"content":{"rendered":"\n<p>Since the California Consumer Privacy Act (CCPA) came into effect in 2020, businesses processing personal data of California residents have needed to give website visitors, app users, and others the option to opt out of the sale or sharing of their personal information (PI).&nbsp;<\/p>\n\n\n\n<p>A CCPA cookie consent banner that communicates to users about the cookies that collect their personal data is a valuable tool for supporting compliance with the data privacy law. It enables organizations to disclose information about their data operations and provide users with required choices about opting out.<\/p>\n\n\n\n<p><br>New and stricter CCPA regulatory requirements came into effect January 1, 2026, which affect these consent tools and the experience provided to users. This guide explains how to design a CCPA cookie banner to comply with the updated requirements.<\/p>\n\n\n<div class=\"uc-key-takeaways\">\n    <div class=\"uc-key-takeaways__container\">\n        <h2 class=\"uc-key-takeaways__title uc-key-takeaways__heading-variarion like-h3\">\n            At a Glance        <\/h2>\n        <div class=\"uc-key-takeaways__content\">\n            <div class=\"uc-key-takeaways__content__inner\">\n                <div class=\"uc-accordion-item uc-accordion-item--opened\" id=\"uc-accordion-item-1\">\n    <span class=\"uc-accordion-item__title no-default-margin\">    <button class=\"uc-accordion-item__button\"\n            id=\"uc-accordion-item-1-button\"\n            aria-expanded=\"true\"\n            aria-controls=\"uc-accordion-item-1-content\">\n        Key Takeaways    <\/button>\n    <\/span>    <div class=\"uc-accordion-item__content\"\n         id=\"uc-accordion-item-1-content\"\n         aria-labelledby=\"uc-accordion-item-1-button\">\n        <div class=\"uc-accordion-item__content__inner\">\n            \n\n<ul class=\"wp-block-list\">\n<li>The major CCPA updates in 2026 are aimed at regulating AI and data privacy challenges with the introduction of the automated decision\u2011making technology (ADMT), cybersecurity audit, high-risk data processing rules, and data broker responsibilities.<\/li>\n\n\n\n<li>The new 2026 CCPA cookie banner requirements include the symmetric rules in its UI\/UX design, GPC signal confirmation, and dark pattern prohibition.&nbsp;<\/li>\n\n\n\n<li>Even though CCPA doesn\u2019t require a consent banner, it\u2019s the most practical way to surface the \u201cDo Not Sell or Share My Personal Information\u201d link, provide a Notice at Collection, and inform users about their rights regarding use of CCPA cookies.<\/li>\n\n\n\n<li>A CCPA banner would follow the opt-out consent model, so the clear and accessible ability to decline CCPA cookies is important, as is transparency about data handling.<\/li>\n\n\n\n<li>Even though cookie consent requirements are different for CCPA and GDPR jurisdictions, a consent management platform can manage both frameworks from a single interface, using geolocation rules.<\/li>\n\n\n\n<li>Failure to comply with the GPC signal is the most common entry point for enforcement cases against Sephora, Tractor Supply, and other companies, and the upcoming California Opt Me Out Act increases the risk.&nbsp;<\/li>\n<\/ul>\n\n        <\/div>\n    <\/div>\n<\/div>\n            <\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-does-the-ccpa-require-a-cookie-banner\">Does the CCPA Require a Cookie Banner?<\/h2>\n\n\n\n<p>Not explicitly. Instead, the <a href=\"https:\/\/usercentrics.com\/ccpa\/\">CCPA<\/a> stipulates that the websites must feature a \u201c<a href=\"https:\/\/usercentrics.com\/guides\/website-disclaimers\/do-not-sell-my-personal-information\/\">Do Not Sell or Share My Personal Information<\/a>\u201d link to opt out of the business selling, sharing, or using data for targeted advertising. Another CCPA requirement is to add a Notice at Collection to inform users arriving on a website, for example, when they would begin collecting personal information, e.g. from browsing activities or a purchase transaction.<\/p>\n\n\n\n<p>In practice, a consent management platform (CMP) that displays a \u201cDo Not Sell or Share My Personal Information\u201d banner, or one that also includes a CCPA cookies consent notice, is the most practical tool for meeting these requirements.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-gdpr-vs-ccpa-cookie-banner-what-s-the-difference\">GDPR vs CCPA Cookie Banner: What&#8217;s the Difference?<\/h3>\n\n\n\n<p>CCPA cookie banner is designed for and follows the logic of the opt-out consent model. Under all <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/us-data-privacy-laws-by-state\/\">U.S. state privacy laws<\/a> to date, including the <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/california-privacy-rights-act-cpra-enforcement-begins\/\">California Privacy Rights Act (CPRA)<\/a>, in most cases prior user consent is not required to collect and process personal information. The exceptions are most commonly sensitive data and children\u2019s data.&nbsp;<\/p>\n\n\n\n<p>However, notification at the point of collection about data access and use and providing the ability to opt out of certain uses of personal data is required.<\/p>\n\n\n\n<p><br>Under the EU\u2019s <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/the-eu-general-data-protection-regulation\/\">General Data Protection Regulation (GDPR)<\/a>, it\u2019s required to obtain prior consent from users before any data is collected or used.<\/p>\n\n\n<div class=\"uc-notice\">\n    <div class=\"uc-notice__icon\">\n        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M10.8177 17.0093H12.8177V11.0093H10.8177V17.0093ZM11.8177 9.00928C12.1011 9.00928 12.3386 8.91344 12.5302 8.72178C12.7219 8.53011 12.8177 8.29261 12.8177 8.00928C12.8177 7.72594 12.7219 7.48844 12.5302 7.29678C12.3386 7.10511 12.1011 7.00928 11.8177 7.00928C11.5344 7.00928 11.2969 7.10511 11.1052 7.29678C10.9136 7.48844 10.8177 7.72594 10.8177 8.00928C10.8177 8.29261 10.9136 8.53011 11.1052 8.72178C11.2969 8.91344 11.5344 9.00928 11.8177 9.00928ZM11.8177 22.0093C10.4344 22.0093 9.13442 21.7468 7.91775 21.2218C6.70108 20.6968 5.64275 19.9843 4.74275 19.0843C3.84275 18.1843 3.13025 17.1259 2.60525 15.9093C2.08025 14.6926 1.81775 13.3926 1.81775 12.0093C1.81775 10.6259 2.08025 9.32594 2.60525 8.10928C3.13025 6.89261 3.84275 5.83428 4.74275 4.93428C5.64275 4.03428 6.70108 3.32178 7.91775 2.79678C9.13442 2.27178 10.4344 2.00928 11.8177 2.00928C13.2011 2.00928 14.5011 2.27178 15.7177 2.79678C16.9344 3.32178 17.9928 4.03428 18.8927 4.93428C19.7927 5.83428 20.5052 6.89261 21.0302 8.10928C21.5552 9.32594 21.8177 10.6259 21.8177 12.0093C21.8177 13.3926 21.5552 14.6926 21.0302 15.9093C20.5052 17.1259 19.7927 18.1843 18.8927 19.0843C17.9928 19.9843 16.9344 20.6968 15.7177 21.2218C14.5011 21.7468 13.2011 22.0093 11.8177 22.0093Z\" fill=\"black\"\/>\n<\/svg>\n    <\/div>\n    <div class=\"uc-notice__content\">\n                <p><span style=\"font-weight: 400;\">Learn more about <\/span><a href=\"https:\/\/usercentrics.com\/knowledge-hub\/opt-out-vs-opt-in\/\"><span style=\"font-weight: 400;\">opt in vs opt out<\/span><\/a><span style=\"font-weight: 400;\"> consent flows.<\/span><\/p>\n            <\/div>\n<\/div>\n\n\n\n\n\n<p>Still, the 2026 CCPA updates introduce new requirements governing access to sensitive personal information. The CCPA now includes consumers\u2019 neural, biometric, and health information, along with the data of website visitors under the age of 16 as sensitive information. Greater restrictions on access and more stringent security and use requirements apply to that data.<\/p>\n\n\n\n<p>As Usercentrics CMO <a href=\"https:\/\/es.linkedin.com\/in\/adelinapeltea\" target=\"_blank\" rel=\"noreferrer noopener\">Adelina Peltea<\/a> points out, &#8220;Companies already needed to take extra precautions if the data is sensitive or belongs to children, but the kinds of data included are expanding, as are consumers\u2019 expectations around handling it.&#8221; Where sensitive data is involved, the requirements are more like those under the GDPR.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-who-needs-to-comply-with-ccpa-in-2026\">Who Needs To Comply With CCPA in 2026?<\/h3>\n\n\n\n<p>Not every business with customers in California needs to comply with the CCPA\/CPRA. Organizations need to meet at least one of the following compliance thresholds:&nbsp;<\/p>\n\n\n\n<div class=\"uc-article-list-timeline   uc-ctx--base\" style=\"\">\n            <div class=\"uc-article-list-timeline__header\">\n                                        <figure class=\"uc-article-list-timeline__header-image\">\n                    <img decoding=\"async\" class=\"uc-article-list-timeline__header-image-element\"\n                         src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/List-Component-CCPA-cookie-banner-requirements.svg?v=b1d7078e13ddc49b\"\n                         alt=\"\">\n                <\/figure>\n                    <\/div>\n        <div class=\"uc-article-list-timeline__list\">\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Generate USD 25,000,000 or more in annual revenue (adjusted every two years to the Consumer Price Index)<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Buy, sell, or share the PI of 100,000 or more California residents or households per year<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Earn 50 percent or more of their annual revenue from selling or sharing PI<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n            <\/div>\n<\/div>\n\n\n\n<div style=\"height:33px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>Failing to comply with requirements, as outlined below in the CCPA cookie compliance checklist, can result in significant <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/ccpa-penalties\/\">CCPA-related penalties<\/a>, as the landmark enforcement case of the USD 1.35M fine against Tractor Supply Company in September 2025 shows.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-is-a-notice-at-collection-under-the-ccpa\">What Is a Notice at Collection Under the CCPA?<\/h2>\n\n\n\n<p>The CCPA Notice at Collection requirement means that organizations have to make disclosures to consumers before or when data collection starts. Those disclosures need to include information about data collection and use, users\u2019 rights, and how to exercise them. The privacy policy can be part of this notice, and the \u201cDo Not Sell or Share\u201d link enables part of the rights requirement.<\/p>\n\n\n\n<p>The Notice at Collection must be clear and easy to understand for the average person, and include:<\/p>\n\n\n\n<div class=\"uc-article-list-timeline uc-article-list-timeline--empty-header uc-article-list-timeline--no-image uc-ctx--base\" style=\"\">\n        <div class=\"uc-article-list-timeline__list\">\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Categories of personal information collected, including sensitive personal information<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Purposes for data collection and usage <\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Statement whether the data is sold or shared (with the opt-out link)<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Retention period for each category of personal information collected<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Link to the privacy policy<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n            <\/div>\n<\/div>\n\n\n\n<div style=\"height:33px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>A CCPA opt-out banner enables you to display and link to this information, as well as provide the user opt-out options.<\/p>\n\n\n<div id=\"uc-cta_69f2192fe5db2\" class=\"uc-cta uc-cta--button uc-cta--size-full uc-cta--primary uc-ctx--blue\">\n    <div class=\"uc-cta__inner container\">\n        <div class=\"uc-cta__content\">\n                                        <div class=\"uc-cta__heading no-default-margin\">Generate a CCPA privacy policy to meet your compliance obligations.<\/div>\n                                        <div class=\"uc-cta__description\">\n                    <p><span style=\"font-weight: 400;\">Try the Usercentrics Privacy Policy Generator for free and get your customized policy in minutes.<\/span><\/p>\n                <\/div>\n                                                                    <\/div>\n                            <div class=\"uc-cta__section\">\n                                        <a id=\"d9511e31-ab54-4769-b5b7-4dcfecafc67f\" class=\"uc-button uc-button-size-m uc-button-contained  no-default-link-decoration\" href=\"https:\/\/usercentrics.com\/us\/privacy-policy-generator\/\" target=\"\"><span>Generate policy<\/span><\/a>                                    <\/div>\n            <\/div>\n<\/div>\n    <script type=\"module\">\n        new Uc_Cta(document.getElementById(\"uc-cta_69f2192fe5db2\"));\n    <\/script>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ccpa-cookie-banner-requirements-the-compliance-checklist\">CCPA Cookie Banner Requirements: The Compliance Checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><span style=\"letter-spacing: -0.2px;\">The banner is prominently displayed on the first visit to the website to meet Notice at Collection requirement.<\/span><\/li>\n\n\n\n<li>All the categories of cookies and personal data collected are disclosed.<\/li>\n\n\n\n<li>Purpose of data collection is stated clearly and transparently.<\/li>\n\n\n\n<li>Explains whether the information is shared or sold.<\/li>\n\n\n\n<li>Includes a &#8220;Do Not Sell or Share My Personal Information&#8221; link.<\/li>\n\n\n\n<li>Links to the privacy policy.<\/li>\n\n\n\n<li>Includes &#8220;Limit the Use of My Sensitive Personal Information&#8221; link (if collecting sensitive data).<\/li>\n\n\n\n<li>Honors <a href=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/global-privacy-control-gpc-usercentrics-signaling\/\">Global Privacy Control (GPC) signals<\/a>.<\/li>\n\n\n\n<li>Obtains opt-in consent from parent\/guardian for minors under 16.<\/li>\n<\/ul>\n\n\n\n<p><strong>Additional updates for 2026:\u00a0<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Presents confirmation to the user that a GPC signal has been processed, e.g. displaying \u201cGPC Honored\u201d.<\/li>\n\n\n\n<li>Provides symmetrical choices, i.e. the opt-out\/decline option easily accessible (and, where opt-in is required, both are equally visible and accessible).<\/li>\n\n\n\n<li>Closing or dismissing the banner without taking an action cannot be construed as the user providing consent (where required).<\/li>\n<\/ul>\n\n\n<div id=\"uc-cta_69f2192fe6c1a\" class=\"uc-cta uc-cta--button uc-cta--size-full uc-cta--primary uc-ctx--blue\">\n    <div class=\"uc-cta__inner container\">\n        <div class=\"uc-cta__content\">\n                                        <div class=\"uc-cta__heading no-default-margin\">Design a compliant and user-friendly CCPA cookie banner <\/div>\n                                        <div class=\"uc-cta__description\">\n                    <p><span style=\"font-weight: 400;\">Learn how to design your consent banner to support CCPA requirements, build visitor trust, and reduce opt-outs.<\/span><\/p>\n                <\/div>\n                                                                    <\/div>\n                            <div class=\"uc-cta__section\">\n                                        <a id=\"432b9340-a2b9-473d-841d-6f747c9ae190\" class=\"uc-button uc-button-size-m uc-button-contained  no-default-link-decoration\" href=\"https:\/\/usercentrics.com\/resources\/cookie-banner-design\/\" target=\"\"><span>Download checklist <\/span><\/a>                                    <\/div>\n            <\/div>\n<\/div>\n    <script type=\"module\">\n        new Uc_Cta(document.getElementById(\"uc-cta_69f2192fe6c1a\"));\n    <\/script>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ccpa-cookie-banner-requirements-2026-updates-explained\">CCPA Cookie Banner Requirements 2026: Updates Explained<\/h2>\n\n\n\n<p>In response to <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/data-privacy-artificial-intelligence\/\">AI and data privacy<\/a> implications, CCPA requirements have been updated to strengthen consumer data rights in light of evolving algorithms, use of dark patterns, and new technologies. The updates required most businesses to review their policies, notices, internal processes, and\/or vendor agreements to meet the new standards. The first requirements came into effect January 1, 2026, but there are several relevant dates:<\/p>\n\n\n\n<div style=\"height:11px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><strong>January 1, 2026<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public-facing consumer rights mechanisms<\/li>\n\n\n\n<li>Privacy policy updates<\/li>\n\n\n\n<li>Dark pattern prohibitions<\/li>\n\n\n\n<li>Consent management protocols<\/li>\n<\/ul>\n\n\n\n<p>Unlike previous CCPA updates, these requirements took effect with no delayed enforcement window.<\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><strong>January 1, 2027<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Automated Decision-Making Technology (ADMT) notices and opt-out requirements begin, covering significant decisions in areas such as credit, employment, and healthcare<\/li>\n<\/ul>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p><strong>April 1, 2028<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Businesses must conduct risk assessments for activities initiated in 2026\u20132027 before starting those activities and submit attestations<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cybersecurity audits, phased by revenue:\n<ul class=\"wp-block-list\">\n<li>April 1, 2028 if 2026 gross revenue exceeded USD 100 million<\/li>\n\n\n\n<li>April 1, 2029 if 2026 gross revenue is between USD 50\u2013100 million<\/li>\n\n\n\n<li>April 1, 2030 if 2026 gross revenue is under USD 50 million<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-the-symmetry-requirement-for-the-ccpa-banner-design\">The Symmetry Requirement for the CCPA Banner Design<\/h3>\n\n\n\n<p>Under the CCPA, consent interfaces must offer &#8220;symmetry in choice.&#8221; In practice, this means:<\/p>\n\n\n\n<div class=\"uc-article-list-timeline uc-article-list-timeline--empty-header uc-article-list-timeline--no-image uc-ctx--base\" style=\"\">\n        <div class=\"uc-article-list-timeline__list\">\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">An equal number of steps in the opt-in and opt-out flows<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Equivalent button pairings, such as &#8220;Yes&#8221; vs. &#8220;No,&#8221; or &#8220;Accept All&#8221; vs. &#8220;Decline All&#8221;, rather than asymmetric alternatives such as &#8220;Accept All&#8221; vs. &#8220;More Information&#8221; or &#8220;Yes&#8221; vs. &#8220;Ask me later&#8221;<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Equal visual prominence for affirmative and opt-out options in the banner design<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n            <\/div>\n<\/div>\n\n\n\n<div style=\"height:17px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>In short: the path to opting out must be no harder to find or complete than the path to accepting.<\/p>\n\n\n\n<p>Honda faced a CPPA enforcement action of USD 632,000 in March 2025. One of the issues was offering an asymmetric cookie banner that made opting out more difficult than opting in.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-symmetry-in-choice-how-to-make-your-consent-banner-ccpa-compliant-in-2026\">Symmetry in choice: How to make your consent banner CCPA-compliant in 2026<\/h4>\n\n\n\n<p>Before updating your banner, audit both the opt-in and opt-out flows. The opt-out request, which should be accessible via the &#8220;Do Not Sell or Share My Personal Information&#8221; link, should require no more steps than the opt-in flow. Also ensure &#8220;No&#8221; or &#8220;Decline All&#8221; buttons appear wherever &#8220;Yes&#8221; or &#8220;Accept All&#8221; appear, at equal size and prominence.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1008\" height=\"413\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Consent-banner_article.png\" alt=\"\" class=\"wp-image-18525\" srcset=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Consent-banner_article.png 1008w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Consent-banner_article-300x123.png 300w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Consent-banner_article-768x315.png 768w\" sizes=\"(max-width: 1008px) 100vw, 1008px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-closing-a-banner-no-longer-implies-consent\">Closing a Banner No Longer Implies Consent<\/h3>\n\n\n\n<p>Previously under the CCPA, there was no legal provision about the action of closing a consent banner as an indicator of a preferred consent option. As of 2026, though, the law\u2019s update states that \u201cclosing or navigating away from a pop-up window [&#8230;] shall not constitute consent\u201d without an affirmative &#8220;I Accept&#8221; signal from a user. This is now in line with GDPR requirements as well.<\/p>\n\n\n\n<p>While in most cases organizations don\u2019t need prior opt-in consent from users, in cases where they do (sensitive data or children\u2019s data), valid consent has to be an active and voluntary action. Construing closing a consent banner without making a choice as the user consenting is not allowed. It is now considered a <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/dark-patterns-and-how-they-affect-consent\/\">dark pattern<\/a>, and California regulators have identified dark patterns as an enforcement priority.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-closing-the-banner-how-to-make-your-consent-banner-ccpa-compliant-in-2026-nbsp\">Closing the banner: How to make your consent banner CCPA-compliant in 2026&nbsp;<\/h4>\n\n\n\n<p>Ensure your consent banner design includes clear, relevant information about user choice, with equally visible and accessible options to accept or decline consent for data use. If the banner has a close option (e.g., a clickable X in the top corner) and a user closes it (or ignores and scrolls past) this cannot be considered giving consent and any data collection or use requiring prior opt-in consent cannot begin.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"211\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article-1024x211.png\" alt=\"\" class=\"wp-image-18528\" srcset=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article-1024x211.png 1024w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article-300x62.png 300w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article-768x158.png 768w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article-1536x317.png 1536w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article.png 1999w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-gpc-opt-out-confirmation-is-now-mandatory\">GPC Opt-Out Confirmation Is Now Mandatory<\/h3>\n\n\n\n<p><a href=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/global-privacy-control-gpc-usercentrics-signaling\/\">Global Privacy Control (GPC)<\/a> is a browser-based signal that communicates a visitor&#8217;s preference to opt out of the sale or sharing of their personal data. Several U.S. state privacy laws now recognize GPC as a valid opt-out mechanism. (As of early 2026, 12 states\u2019 privacy laws require honoring the GPC or other Universal Opt-Out Mechanism.)<\/p>\n\n\n\n<p>GPC is not the only recognized opt-out signal under CCPA. Businesses must respond to any commonly recognized opt-out preference signal in the same manner. GPC is simply the most widely adopted at present, and is supported by Usercentrics CMP. Provisions of the <a href=\"https:\/\/privacy.ca.gov\/2026\/01\/californias-opt-me-out-act-your-privacy-just-got-easier\/\" target=\"_blank\" rel=\"noreferrer noopener\">California Opt Me Out Act<\/a> (effective January 2027) will make the requirements regarding opt-out signal technologies and honoring signals even more strict.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-gpc-how-to-make-your-consent-banner-ccpa-compliant-in-2026-nbsp\">GPC: How to make your consent banner CCPA-compliant in 2026&nbsp;<\/h4>\n\n\n\n<p>To meet CCPA requirements for GPC, websites must:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Recognize incoming GPC signals<\/li>\n\n\n\n<li>Treat them as valid opt-out requests<\/li>\n\n\n\n<li>Notify the visitor that their signal has been processed (e.g., \u201cOpt-out Signal Honored\u201d or \u201cThe GPC signal is honored\u201d) and will have the effect of opting them out of the sale and sharing of their personal information<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"760\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article_US-1024x760.png\" alt=\"\" class=\"wp-image-18529\" srcset=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article_US-1024x760.png 1024w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article_US-300x223.png 300w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article_US-768x570.png 768w, https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/banner-article_US.png 1186w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-what-s-coming-the-california-opt-me-out-act-nbsp\">What&#8217;s Coming: The California Opt Me Out Act&nbsp;<\/h3>\n\n\n\n<p>The California Opt Me Out Act, passed in 2025 and effective January 1, 2027, requires all browsers operating in California to offer opt-out preference signal (OOPS) functionality \u2014 including support for GPC \u2014 with clear, accessible descriptions of what the signal does and how to enable it.<\/p>\n\n\n\n<p>The Act reinforces and extends existing CCPA obligations. Where the CCPA requires businesses to honor GPC signals, the California Opt Me Out Act works from the browser side, making it significantly easier for visitors to activate and deploy those signals in the first place. The practical effect is that more California residents will likely use opt-out signals, and businesses will see a higher volume of GPC requests to process and confirm.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"h-what-the-california-opt-me-out-act-means-for-multi-state-businesses\">What the California Opt Me Out Act means for multi-state businesses<\/h4>\n\n\n\n<p>The California Opt Me Out Act applies only in California, so to people located there and their browsers. Privacy laws in many other states do not require browsers to offer OOPS functionality, at least not yet.&nbsp;<\/p>\n\n\n\n<p>Businesses operating across multiple states will need to account for this inconsistency, ensuring GPC and similar signals are handled correctly for California visitors without assuming equivalent obligations apply elsewhere. As noted earlier, however, 12 states currently require honoring some sort of opt-out signal, and more are likely to follow.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ccpa-vs-gdpr-cookie-banner-key-differences\">CCPA vs. GDPR Cookie Banner: Key Differences<\/h2>\n\n\n\n<p>The table below provides the CCPA vs GDPR cookie banner difference details.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Requirement<\/strong><\/td><td><strong>CCPA<\/strong><\/td><td><strong>GDPR<\/strong><\/td><\/tr><tr><td>Consent model<\/td><td>Opt-out consent<\/td><td>Opt-in consent<\/td><\/tr><tr><td>Cookie management<\/td><td>Can load before user action<\/td><td>Load only after user consent<\/td><\/tr><tr><td>\u201cDo Not Sell or Share&#8221; link requirement<\/td><td>Legally required<\/td><td>Not applicable<\/td><\/tr><tr><td>Honoring GPC\/UOOM<\/td><td>Legally required<\/td><td>Not legally required (consent withdrawal or right to object are similar requirements in some processing contexts)<\/td><\/tr><tr><td>User notification<\/td><td>Legally required (Notice at Collection must be provided at or before the point of data collection)<\/td><td>Legally required (comprehensive transparency notice must be provided at the time of collection, per Arts. 12, 13, 14 GDPR)<\/td><\/tr><tr><td>Consent record-keeping requirements<\/td><td>Legally required (records of consumer requests and responses must be retained for a minimum of 24 months)&nbsp;<\/td><td>Legally required [controllers must be able to demonstrate that consent was validly obtained under Article 7(1); no prescribed retention period]<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<div style=\"height:8px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>Despite varying requirements, businesses operating in the U.S. and EU don\u2019t need to create separate <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/cookie-banner\/\">cookie banners<\/a> to comply with both the CCPA and GDPR. Usercentrics <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/consent-management-platforms\/\">consent management platforms<\/a> have geolocation functionality and enable flexible configuration so the right user sees the right information and is offered the legally required consent options \u2014 anywhere in the world.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-real-world-ccpa-enforcement-what-happens-if-you-get-it-wrong\">Real-World CCPA Enforcement: What Happens if You Get It Wrong<\/h2>\n\n\n\n<p>Non-compliance with CCPA can have a variety of negative consequences. It erodes the trust with customers who have rising concerns about access to their data, AI ethics, <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/tracking-cookies\/\">cookie tracking<\/a>, and other technical concerns.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Most notably, though, CCPA non-compliance can result in hefty fines and other regulatory penalties:<\/p>\n\n\n\n<div class=\"uc-article-list-timeline uc-article-list-timeline--empty-header uc-article-list-timeline--no-image uc-ctx--base\" style=\"\">\n        <div class=\"uc-article-list-timeline__list\">\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement\" target=\"_blank\" rel=\"noopener\"><b>Sephora<\/b><\/a><b> (USD 1.2 million, August 2022)<\/b><span style=\"font-weight: 400;\">: Fined due to the failure to disclose sales and to honor GPC signals. Sephora was obligated to clarify its online disclosures, update the privacy policy, honor GPC signals, and review its service provider agreement.<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155\" target=\"_blank\" rel=\"noopener\"><b>Healthline<\/b><\/a><b> (USD 1.55 million, July 2025)<\/b><span style=\"font-weight: 400;\">: The health information website failed to provide an opt-out mechanism from targeted advertising, violating the purpose limitation principle, deceiving its customers, and maintaining non-compliant contracts.<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><a href=\"https:\/\/cppa.ca.gov\/announcements\/2025\/20250930.html\" target=\"_blank\" rel=\"noopener\"><b>Tractor Supply<\/b><\/a><b> (USD 1.35 million, September 2025)<\/b><span style=\"font-weight: 400;\">: The nation\u2019s largest rural lifestyle retailer also didn\u2019t provide effective opt-out mechanisms and disclosed personal information to third parties. Other violations included failures to maintain privacy policy, inform job applicants of their privacy rights, and honor the GPC signal. <\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><a href=\"https:\/\/cppa.ca.gov\/announcements\/2025\/20250312.html\" target=\"_blank\" rel=\"noopener\"><b>Honda<\/b><\/a><b> (USD 632,000, March 2025)<\/b><span style=\"font-weight: 400;\">: The company violated Californians\u2019 privacy rights by offering an asymmetric cookie banner, requiring verification and complicating the opt out process, and sharing consumers\u2019 personal information with ad tech companies under non-compliant contracts.<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><a href=\"https:\/\/oag.ca.gov\/news\/press-releases\/california-wont-let-it-go-attorney-general-bonta-announces-275-million\" target=\"_blank\" rel=\"noopener\"><b>Disney<\/b><\/a><b> (USD 2.75 million, February 2026)<\/b><span style=\"font-weight: 400;\">: The biggest fine to date as of early 2026 due to the failure to provide effective opt-out mechanisms and recognize the GPC signal.<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n            <\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-4-steps-to-support-ccpa-cpra-cookie-and-consent-compliance\">4 Steps To Support CCPA\/CPRA Cookie and Consent Compliance<\/h2>\n\n\n\n<p>The following steps cover what your organization needs to do to meet current and updated CCPA requirements for your website and consent banner.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-1-determine-whether-your-business-needs-to-comply-with-the-ccpa-cpra\">1. Determine Whether Your Business Needs To Comply With the CCPA\/CPRA<\/h3>\n\n\n\n<p>The CCPA\/CPRA applies to for-profit businesses that meet at least one of three threshold criteria\u2014&nbsp; annual gross revenue over USD 25 million, 100,000 or more CA residents&#8217; data processed annually, or more than 50 percent annual revenue from data sales or sharing). The first step is to confirm whether your business meets CCPA threshold criteria.<\/p>\n\n\n\n<p>Review your financial statements to determine your gross annual revenue and what percentage of your income comes from selling or sharing PI. Also, conduct an audit to determine how many California residents\u2019 PI your business handles annually. Many businesses that run advertising will meet at least one compliance threshold.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-2-audit-cookies-and-tracking-technologies-on-your-site\">2. Audit Cookies and Tracking Technologies on Your Site<\/h3>\n\n\n\n<p>Identify all the cookies and other tracking technologies in use on your website, including who sets them, and what data they collect. If you collect sensitive or children\u2019s data, you may need consent before they fire, or you may just need to ensure GPC signals and other opt-outs are honored.&nbsp;<\/p>\n\n\n\n<p>Make sure that your privacy policy includes clear information on your data collection and processing practices, including the types of cookies used and types of data collected, as well as the purposes for collection. And make sure users have easy access to opting out of data sale, sharing, or targeted advertising via the \u201cDo Not Sell or Share\u2026\u201d link.<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n<div class=\"uc-quote\">\n    <div class=\"uc-quote__inner\" style=\"--photo-size: var(--sz-128);\">\n                <div class=\"uc-quote__text\">\u201cEven where prior consent is not required, companies still have privacy obligations. Privacy notices have to be up to date and free of technical or legal jargon so the average person can understand them. And they have to provide all the information about what\u2019s happening with people\u2019s data and how they can exercise their rights, including opting out. Privacy laws are continuing to evolve and getting stricter on this point.\u201d<\/div>\n                <div class=\"uc-quote__author-info\">\n                            <div class=\"uc-quote__photo-wp\">\n                    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2023\/11\/Adelina-Peltea-CMO.jpg\"\n                         srcset=\"\"\n                         alt=\"Adelina Peltea CMO\"\n                         class=\"uc-quote__photo\"\n                         width=\"128\"\n                         height=\"128\"\n                         sizes=\"128px\"\n                    >\n                <\/div>\n                        <div class=\"uc-quote__author-info__text\">\n                                    <div class=\"uc-quote__author like-h5 no-default-margin\">Adelina Peltea<\/div>\n                                                    <div class=\"uc-quote__position\">&mdash; CMO of Usercentrics<\/div>\n                                            <\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-3-configure-your-do-not-sell-or-share-opt-out-mechanism-and-gpc-signal-recognition\">3. Configure Your &#8220;Do Not Sell or Share&#8221; Opt-Out Mechanism and GPC Signal Recognition<\/h3>\n\n\n\n<p>Your website should be able to recognize the GPC signal for visitors in California and from other states where it\u2019s required, and they should also see a clear and prominent notice that the opt-out signal has been honored.&nbsp;<\/p>\n\n\n\n<p>Visitors must also have easy access to a \u201cDo Not Sell or Share My Personal Information\u201d link, often located in the footer. If they opt out of sale, sharing, and\/or targeted advertising, you must honor that and stop collecting or processing their data as soon as possible (within 15 business days from receipt).<\/p>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n<div class=\"uc-quote\">\n    <div class=\"uc-quote__inner\" style=\"--photo-size: var(--sz-128);\">\n                <div class=\"uc-quote__text\">\u201cThe most important step for complying with the CCPA is to make sure that users have clear and accessible opt-out options. Just because you may not need to get prior consent doesn\u2019t mean that consent doesn\u2019t matter in California. Make the \u2018Do Not Sell or Share My Personal Information\u2019 link easy to access and ensure that if visitors use it you stop collecting and using their data as soon as possible.\u201d<\/div>\n                <div class=\"uc-quote__author-info\">\n                            <div class=\"uc-quote__photo-wp\">\n                    <img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2023\/11\/Adelina-Peltea-CMO.jpg\"\n                         srcset=\"\"\n                         alt=\"Adelina Peltea CMO\"\n                         class=\"uc-quote__photo\"\n                         width=\"128\"\n                         height=\"128\"\n                         sizes=\"128px\"\n                    >\n                <\/div>\n                        <div class=\"uc-quote__author-info__text\">\n                                    <div class=\"uc-quote__author like-h5 no-default-margin\">Adelina Peltea<\/div>\n                                                    <div class=\"uc-quote__position\">&mdash; CMO of Usercentrics<\/div>\n                                            <\/div>\n        <\/div>\n    <\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-4-design-a-ccpa-compliant-privacy-notice-and-opt-out-mechanism\">4. Design a CCPA-Compliant Privacy Notice and Opt-Out Mechanism<\/h3>\n\n\n\n<p>Under the CCPA&#8217;s opt-out model, consumers have the right to be informed about data collection before or at the point it occurs, and to direct you not to sell or share their personal information. A compliant implementation should:<\/p>\n\n\n\n<div class=\"uc-article-list-timeline uc-article-list-timeline--empty-header uc-article-list-timeline--no-image uc-ctx--base\" style=\"\">\n        <div class=\"uc-article-list-timeline__list\">\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Display a Notice at Collection at or before the point of data collection, wherever that occurs on your site<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Clearly disclose what categories of personal information you collect and the purposes for which you collect it (such as analytics, personalization, or targeted advertising)<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Indicate how long you retain each category of personal information, or the criteria used to determine that period<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Inform users whether their personal information is sold or shared with third parties<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Provide a clearly visible &#8220;Do Not Sell or Share My Personal Information&#8221; link, accessible from your homepage and any page where personal information is collected<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Ensure opting out is no more difficult than any opt-in mechanism you offer<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Display visible confirmation \u2014 such as &#8220;Opt-Out Request Honored&#8221; \u2014 when a user exercises their opt-out right, including via a GPC signal<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n                    <div class=\"uc-article-list-timeline__item\">\n                <div class=\"uc-article-list-timeline__item-graphics \">\n                    <div class=\"uc-article-list-timeline__item-bullet uc-article-list-timeline__item-bullet--icon\">\n                        <svg width=\"24\" height=\"24\" viewBox=\"0 0 24 24\" fill=\"none\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\">\n<path d=\"M9.63335 17.838L3.93335 12.138L5.35835 10.713L9.63335 14.988L18.8084 5.81299L20.2334 7.23799L9.63335 17.838Z\" fill=\"black\"\/>\n<\/svg>\n                    <\/div>\n                <\/div>\n\n                <div class=\"uc-article-list-timeline__item-content\">\n                                        <div class=\"uc-article-list-timeline__item-description\">\n                        <p><span style=\"font-weight: 400;\">Honor opt-out requests as soon as feasibly possible, and no later than 15 business days from receipt<\/span><\/p>\n                    <\/div>\n                <\/div>\n            <\/div>\n            <\/div>\n<\/div>\n\n\n<div id=\"uc-cta_69f2192fef792\" class=\"uc-cta uc-cta--button uc-cta--size-full uc-cta--primary uc-ctx--blue\">\n    <div class=\"uc-cta__inner container\">\n        <div class=\"uc-cta__content\">\n                                        <div class=\"uc-cta__heading no-default-margin\">CCPA compliance support at scale<\/div>\n                                        <div class=\"uc-cta__description\">\n                    <p><span style=\"font-weight: 400;\">Usercentrics CMP automates cookie scanning, banner configuration, GPC signal recognition, and consent logging, along with updates as regulations change. <\/span><\/p>\n                <\/div>\n                                                                    <\/div>\n                            <div class=\"uc-cta__section\">\n                                        <a id=\"bb11cce9-4976-4dd1-973f-ab19ad83f6eb\" class=\"uc-button uc-button-size-m uc-button-contained  no-default-link-decoration\" href=\"https:\/\/usercentrics.com\/us\/ccpa\/\" target=\"\"><span>Start free trial <\/span><\/a>                                    <\/div>\n            <\/div>\n<\/div>\n    <script type=\"module\">\n        new Uc_Cta(document.getElementById(\"uc-cta_69f2192fef792\"));\n    <\/script>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-usercentrics-helps-with-ccpa-cookie-banner-compliance\">How Usercentrics Helps With CCPA Cookie Banner Compliance<\/h2>\n\n\n\n<p>Usercentrics CMP includes a set of features designed to help your organization meet CCPA cookie banner requirements and manage consent across jurisdictions today and as the law continues to evolve.<\/p>\n\n\n\n<p>Automated cookie scanning identifies all cookies and tracking technologies on your website, giving you an accurate picture of what needs to be disclosed and managed. Pre-configured CCPA banner templates are built with symmetrical Accept and Decline options, supporting the 2026 symmetry requirement out of the box.&nbsp;<\/p>\n\n\n\n<p>GPC signal recognition and processing is built in, with confirmation displayed to visitors as required under the updated regulations. The &#8220;Do Not Sell or Share My Personal Information&#8221; link can be configured directly within the platform, alongside consent logging and an audit trail to support compliance reviews.<\/p>\n\n\n\n<p>For multi-state operations, smart geotargeting displays the CCPA banner only to California visitors, avoiding unnecessary friction for visitors in other regions. And because U.S. state privacy laws and the GDPR operate in parallel for many businesses, Usercentrics CMP supports both frameworks from a single platform so consent flows for different jurisdictions can be managed without maintaining separate systems.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The CCPA doesn&#8217;t mandate a cookie banner, but one remains the most practical way to meet its notice and opt-out requirements. The 2026 updates tighten the rules: clear notice and opt-out options, GPC signal confirmation, and a ban on dark patterns. This guide covers what changed, who must comply, and how to build a compliant banner.<\/p>\n","protected":false},"featured_media":18519,"template":"","meta":{"_acf_changed":false,"editor_notices":[],"footnotes":""},"tags":[],"magazine_issue":[],"magazine_tag":[],"resource_tag":[],"class_list":["post-18518","knowledge","type-knowledge","status-publish","has-post-thumbnail","hentry"],"acf":[],"yoast_head":"<title>CCPA Cookie Banner Requirements: Steps for Compliance<\/title>\n<meta name=\"description\" content=\"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CCPA Cookie Banner Requirements: Steps for Compliance in 2026\" \/>\n<meta property=\"og:description\" content=\"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/\" \/>\n<meta property=\"og:site_name\" content=\"Usercentrics - US\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/usercentrics\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-24T16:58:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/SoMe-CCPA-Cookie-Banner-Requirements-1000x630px.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@usercentrics\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"14 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/\",\"name\":\"CCPA Cookie Banner Requirements: Steps for Compliance\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2026\\\/04\\\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg\",\"datePublished\":\"2026-04-24T15:52:12+00:00\",\"dateModified\":\"2026-04-24T16:58:43+00:00\",\"description\":\"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/\"}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/#primaryimage\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2026\\\/04\\\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg\",\"contentUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2026\\\/04\\\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg\",\"width\":1000,\"height\":1000,\"copyrightNotice\":\"\u00a9 Copyright 2026 Usercentrics GmbH\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Usercentrics GmbH\"},\"creditText\":\"Image: Usercentrics GmbH\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"CCPA Cookie Banner Requirements: Steps for Compliance in 2026\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/ccpa-cookie-banner\\\/\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/\",\"name\":\"Usercentrics - US\",\"description\":\"Consent Management Platform (CMP) Usercentrics\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/?s={search_term_string}\"}}],\"inLanguage\":\"en-US\"}]}<\/script>","yoast_head_json":{"title":"CCPA Cookie Banner Requirements: Steps for Compliance","description":"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/","og_locale":"en_US","og_type":"article","og_title":"CCPA Cookie Banner Requirements: Steps for Compliance in 2026","og_description":"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.","og_url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/","og_site_name":"Usercentrics - US","article_publisher":"https:\/\/www.facebook.com\/usercentrics","article_modified_time":"2026-04-24T16:58:43+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/SoMe-CCPA-Cookie-Banner-Requirements-1000x630px.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@usercentrics","twitter_misc":{"Est. reading time":"14 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/","url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/","name":"CCPA Cookie Banner Requirements: Steps for Compliance","isPartOf":{"@id":"https:\/\/usercentrics.com\/us\/#website"},"primaryImageOfPage":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/#primaryimage"},"image":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/#primaryimage"},"thumbnailUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg","datePublished":"2026-04-24T15:52:12+00:00","dateModified":"2026-04-24T16:58:43+00:00","description":"Learn how to set up a CCPA cookie consent banner. Details on the new CCPA cookie banner requirements and practical steps to design CCPA cookies notice.","breadcrumb":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/"}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/#primaryimage","url":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg","contentUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2026\/04\/Hero-CCPA-Cookie-Banner-Requirements-1000x1000-1.jpg","width":1000,"height":1000,"copyrightNotice":"\u00a9 Copyright 2026 Usercentrics GmbH","creator":{"@type":"Organization","name":"Usercentrics GmbH"},"creditText":"Image: Usercentrics GmbH"},{"@type":"BreadcrumbList","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Resources","item":"https:\/\/usercentrics.com\/us\/resources\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/"},{"@type":"ListItem","position":3,"name":"CCPA Cookie Banner Requirements: Steps for Compliance in 2026","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/ccpa-cookie-banner\/"}]},{"@type":"WebSite","@id":"https:\/\/usercentrics.com\/us\/#website","url":"https:\/\/usercentrics.com\/us\/","name":"Usercentrics - US","description":"Consent Management Platform (CMP) Usercentrics","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/usercentrics.com\/us\/?s={search_term_string}"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/18518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge"}],"about":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/types\/knowledge"}],"version-history":[{"count":0,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/18518\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media\/18519"}],"wp:attachment":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media?parent=18518"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/tags?post=18518"},{"taxonomy":"magazine_issue","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_issue?post=18518"},{"taxonomy":"magazine_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_tag?post=18518"},{"taxonomy":"resource_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/resource_tag?post=18518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}