CCPA compliance for website tracking: pixels, GA4 and opt-outs

CCPA compliance for website tracking means one thing above all: if your pixels and tags sell or share personal information, California visitors must be able to opt out, and your tags must actually stop when they do. The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act (CPRA), treats cookie IDs, IP addresses and browsing behavior as personal information, so ordinary marketing tags are inside its scope.

This guide explains which tracking counts as selling or sharing, what the opt-out link and the Global Privacy Control signal require, and how to set up Google Tag Manager so the rules are followed in the browser and not only in the privacy policy. This article is not legal advice.

Who has to follow the CCPA?

The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds. The first is annual gross revenue above a set amount, originally 25 million US dollars and adjusted for inflation since then. The second is buying, selling or sharing the personal information of 100,000 or more California residents or households. The third is earning 50 percent or more of annual revenue from selling or sharing personal information.

Where your company is located does not matter. An online shop in Texas or Ontario with many California customers can be covered. Nonprofits and government agencies are generally outside the law. The California Attorney General and the California Privacy Protection Agency (CPPA) both enforce it, and the CPPA writes the detailed regulations.

When does tracking count as selling or sharing?

Tracking counts as selling when personal information goes to another company for money or other valuable consideration, and as sharing when it goes to a third party for cross-context behavioral advertising. The CPRA added the term sharing, which took effect on January 1, 2023, precisely to cover targeted advertising, even when no money changes hands.

In practice this covers most advertising tags. The Meta Pixel, the TikTok Pixel, the LinkedIn Insight Tag and Google Ads remarketing send cookie IDs and page activity to platforms that use them to target ads across other sites and apps. Pure measurement of your own site is different: if Google Analytics 4 (GA4) runs without advertising features, and the provider only processes data on your behalf under a contract, that relationship is easier to classify as a service provider. The line depends on contracts and settings, so document both.

• Usually selling or sharing: retargeting pixels, audience building, conversion tags that feed ad personalization
• Depends on settings: GA4 with Google Signals or linked Google Ads accounts, Meta Conversions API
• Usually not: server logs and analytics used only for your own reporting, under a service provider contract
• Always sensitive: precise location, health information and other sensitive categories have their own rules

→ Cookie banner with Consent Mode v2: compliant, with no monthly license

What the opt-out has to do in practice

A business that sells or shares personal information must give visitors a clear way to opt out, usually a link titled “Do Not Sell or Share My Personal Information” in the footer, or an alternative link that the regulations allow. Visitors must not need an account to use it. After an opt-out, the business generally has to wait at least 12 months before asking the person to opt back in.

The opt-out has to work on the page, not only on paper. If a visitor opts out and the Meta Pixel keeps firing on the next page view, the link is decoration. Equally important: the regulations treat a browser opt-out preference signal such as the Global Privacy Control (GPC) as a valid opt-out request, so a visitor with GPC turned on must be treated as opted out without clicking anything.

How to set up Google Tag Manager for CCPA opt-outs

Google Tag Manager handles CCPA opt-outs best through Google Consent Mode, the same mechanism used for European consent. For visitors in California you set a consent default with the region parameter, for example US-CA, where ad_storage, ad_user_data and ad_personalization start as granted because the law works on an opt-out basis. When the visitor opts out or sends a GPC signal, you update those three values to denied.

Google tags respect the consent state directly. For other tags, the trigger must check the same state. The Meta Pixel has its own Limited Data Use option for US privacy laws, and Google Ads offers restricted data processing. Use these options in addition to blocking, because they tell the platform how to handle data that was already collected. Keep the opt-out in a first-party cookie or local storage so it applies on every page and on later visits.

→ Setting up Google Consent Mode v2 correctly: no warning in Tag Assistant

How to test whether your opt-out really works

Testing an opt-out takes ten minutes and finds most problems. Open your site in a fresh browser profile, click the opt-out link and watch the network tab of the developer tools while you visit two or three more pages. No request should go to Meta, TikTok, LinkedIn or Google Ads remarketing endpoints after the opt-out. Then repeat the test with a browser that sends GPC, such as Brave, or Firefox with the setting turned on.

A typical failure looks like this: a small online shop in San Diego added a footer link that opens a form, the form emails the request to the owner, and nothing changes in the browser. The pixel keeps firing for weeks. Another frequent error is a consent tool that only blocks tags it knows about, while a pixel hard-coded in the theme or added by a shop app keeps running outside Google Tag Manager.

Privacy policy and documentation

The privacy policy must describe the categories of personal information you collect, the purposes, whether you sell or share it, and how visitors can exercise their rights, including the opt-out link. Keep it consistent with what your tags actually do. A list of every tag on the site, its purpose and whether it counts as selling or sharing makes this much easier and helps when the CPPA or a customer asks questions.

Check your site before you change anything

Before you rebuild your setup, look at what really loads. The free Trackum check at trackum.app/check opens your homepage three times in a real browser, with the banner unanswered, rejected and accepted, plus two subpages, and shows which tags and cookies load in each state. It takes about two minutes and needs no sign-up. If you want the fixes done, Trackum sets up Google Tag Manager, GA4 and Consent Mode v2 for a fixed €150 one-time, tested with and without consent, or repairs the findings of the check in your existing container for €79. Prices plus VAT.