What Is the CCPA and How It Affects Your Browsing

The California Consumer Privacy Act (CCPA) gives California residents rights over the personal information businesses collect about them. It took effect in 2020 and was expanded by the California Privacy Rights Act (CPRA), with most changes in force from 2023. Because many companies apply it nationally, it shapes what you see online even outside California.

Your rights

• Know: ask what personal information a business has collected about you and why.
• Delete: ask a business to delete it, with some exceptions.
• Correct: fix inaccurate information.
• Opt out: tell a business not to sell or share your information, including for cross-site advertising.
• Limit: restrict use of sensitive information such as precise location or health data.
• No retaliation: businesses can't punish you for using your rights.

Who it applies to

For-profit businesses that do business in California and meet at least one threshold: annual revenue over about $25 million (adjusted for inflation), buying, selling or sharing information about 100,000 or more California residents or households, or making half their revenue from selling or sharing personal information.

What you see while browsing

• "Do Not Sell or Share My Personal Information" links, usually in the footer.
• Cookie banners on US sites with an opt-out option.
• Privacy policy sections explaining California rights.

Global Privacy Control

Global Privacy Control (GPC) is a browser signal that tells every site you visit you're opting out of sale and sharing. Under California's rules, businesses must treat it as a valid opt-out. In 2022, Sephora paid $1.2 million to settle claims from the state Attorney General, including that it ignored GPC signals.

Firefox has a setting to send GPC, and Brave and DuckDuckGo's browser send it too. Chrome doesn't send it by default, but extensions can add it.

Data brokers

California's Delete Act created a platform run by the state privacy agency where residents can ask every registered data broker to delete their information with one request, launching in 2026.

How to use your rights

1. Turn on GPC in your browser.
2. Use "Do Not Sell or Share" links on sites you use often.
3. Send access or deletion requests through a company's privacy page.
4. Complaints can go to the California Privacy Protection Agency.

Cookie banners

Cookie Auto-Reject clicks reject on many cookie banners automatically. It doesn't send GPC. See privacy laws around the world.