CCPA, GPC and US State Privacy Banner Implementation

Opt-out is a different architecture, not a translated banner

The most expensive mistake in US privacy work is treating it as a localisation exercise. Under GDPR you ask first and track after. Under CCPA and its successors you may track by default, but you must give a clear, working way to stop — and that mechanism has to be present on every page, reachable without an account, and effective without you verifying who the person is.

That inverts the engineering. Instead of gating tags behind a consent event, you are maintaining an opt-out state that has to suppress specific downstream sharing, propagate to your advertising partners, and persist across sessions and devices as far as you reasonably can. A consent banner bolted onto that does not produce compliance; it produces two contradictory states.

Sensitive personal information adds a second axis. Certain categories carry a right to limit use, which is distinct from the sale-and-share opt-out and needs its own control and its own downstream effect. Sites that collapse both into a single toggle are usually failing one of them.

• A conspicuous 'Do Not Sell or Share My Personal Information' link, present site-wide
• An opt-out flow that works without identity verification or account creation
• A separate control for limiting the use of sensitive personal information where it applies
• Opt-out state that persists and propagates to advertising and analytics partners, not just to your own storage
• Notice at collection surfaced where data is actually collected

Global Privacy Control is not optional

GPC is a browser-level signal that communicates an opt-out without the user visiting your banner at all. California treats it as a valid opt-out request, and several other states have followed. If your site ignores it, you are not compliant regardless of how good your banner looks — the user has made a request and you have not honoured it.

Implementing GPC properly is more than reading the header or the JavaScript property. The signal has to translate into the same opt-out state your banner produces, apply on the first page view rather than after a round trip, and be reflected back to the user so they can see their choice was received. That last part matters because a signal you honour silently is indistinguishable, from the user's side, from one you ignored.

It also has to interact sensibly with an explicit later choice. If a user with GPC enabled affirmatively opts back in on your site, the system needs a defined resolution rather than a race between two sources of truth.

• Detection of the GPC signal via header and navigator property, applied before tags load
• Signal mapped into the same opt-out state as an on-site opt-out, not a parallel one
• Visible confirmation to the user that the signal was honoured
• Defined precedence between GPC and a later explicit choice
• IAB GPP string handling where you participate in the US national or state sections

Twenty states, one baseline

Running a distinct banner configuration per state does not scale and produces inconsistencies nobody can audit. The workable approach is a single baseline that satisfies the strictest applicable requirements, with targeted geolocation variation only where a state genuinely diverges in a way that matters to your business.

Which states apply to you is a threshold question — most of these laws have revenue or volume triggers, and a mid-sized business is often in scope for four states rather than twenty. Establishing that first prevents a lot of unnecessary engineering. Where you are in scope broadly, the baseline approach costs less to build and far less to maintain than per-state rule sets.

The variation that does matter tends to be around sensitive data definitions, minors, and whether a state recognises opt-out preference signals. We map those onto your actual data flows rather than onto a generic matrix.

What enforcement has actually punished

The US enforcement record is unusually instructive because the findings are specific and technical. Cases have turned on opt-out flows that required more steps than opting in, on links that were present but did not function, on forms demanding verification for a request that does not require it, and on signals received and not acted upon.

None of those are conceptual failures. They are implementation failures, findable by anyone willing to open the page and click through the flow — which is exactly what regulators did. That is the standard we test against: not whether the controls exist, but whether a determined person following them end to end actually ends up opted out.

We run that walkthrough as part of every engagement and document it. If a regulator asks how you know your opt-out works, the answer should be a test record, not a screenshot of a footer link.