CCPA & US State Privacy Laws for Ad Tech

1. CCPA & CPRA Overview

The California Consumer Privacy Act (CCPA), effective January 1, 2020, was the first comprehensive consumer privacy law in the United States. The California Privacy Rights Act (CPRA), approved by voters in November 2020 as Proposition 24, amended and expanded the CCPA significantly, with enforcement provisions taking effect on July 1, 2023.

Together, CCPA/CPRA grants California residents — approximately 39 million consumers representing the world's fifth-largest economy — substantial rights over their personal information. For the ad tech industry, these laws redefine how consumer data can be collected, shared, and monetized across the programmatic supply chain.

Who Must Comply?

CCPA/CPRA applies to for-profit businesses that collect California consumers' personal information and meet at least one of the following thresholds:

• Annual gross revenue exceeding $25 million (adjusted annually for inflation)
• Annually buys, sells, or shares the personal information of 100,000 or more California consumers or households
• Derives 50% or more of annual revenue from selling or sharing California consumers' personal information

The third threshold is particularly relevant to ad tech: many data brokers, DMPs, and ad networks derive the majority of their revenue from selling or sharing consumer data, bringing them squarely within scope regardless of total revenue.

Key Consumer Rights Under CPRA

• Right to know: Consumers can request disclosure of the categories and specific pieces of personal information collected, the sources, purposes, and third parties with whom data is shared.
• Right to delete: Consumers can request deletion of their personal information, with limited exceptions.
• Right to correct: CPRA added the right to correct inaccurate personal information — a new right not in the original CCPA.
• Right to opt out of sale/sharing: Consumers can direct businesses to stop selling or sharing their personal information for cross-context behavioral advertising.
• Right to limit use of sensitive data: CPRA created a new category of "sensitive personal information" (including precise geolocation, racial/ethnic origin, religious beliefs, genetic data, and health information) and gives consumers the right to limit its use to purposes necessary to provide the requested service.
• Right to non-discrimination: Businesses cannot charge different prices or provide different service quality for exercising privacy rights, though financial incentive programs (loyalty programs) are permitted under specific conditions.

2. "Do Not Sell" Mechanics

The CCPA/CPRA's "Do Not Sell or Share My Personal Information" requirement is the most operationally significant provision for ad tech companies. Here is how it works in practice:

Website-Level Implementation

Businesses that sell or share personal information must provide a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on their website homepage, mobile app, and in their privacy policy. When a consumer clicks this link, the business must stop selling or sharing that consumer's personal information within 15 business days.

Technical Implementation for Programmatic

For publishers and ad tech platforms, implementing "Do Not Sell" involves several technical steps:

1. Signal capture: When a user exercises their opt-out right, the publisher's CMP or privacy interface records the preference and associates it with the user's identifier (cookie, device ID, or authenticated user ID).
2. Signal propagation: The opt-out signal must be communicated to all downstream ad tech partners. The IAB's US Privacy String (part of the CCPA Compliance Framework) encodes the user's opt-out status into a compact string that is passed through OpenRTB bid requests via the regs.ext.us_privacy field.
3. Bid request filtering: DSPs receiving a bid request with a "Do Not Sell" signal must not use that user's personal information for targeting, profiling, or cross-context behavioral advertising. The impression can still be served, but only using non-personalized signals (contextual targeting, geographic targeting at a non-personal level).
4. Data deletion: The consumer's existing profile data held by the publisher, SSP, and downstream vendors should be deleted or de-identified within the statutory timeframe.

Global Privacy Control (GPC)

The Global Privacy Control (GPC) is a browser-level signal that communicates a user's "Do Not Sell" preference automatically, without requiring the user to click an opt-out link on each website. The California Attorney General has confirmed that GPC signals must be honored as valid opt-out requests under CCPA/CPRA. As of 2026, Firefox and several privacy-focused browsers send GPC signals by default, and Chrome has signaled future support.

3. Opt-Out vs Opt-In: The US Model

A fundamental difference between US and EU privacy law is the default posture toward data processing:

• US model (opt-out): Data processing is permitted by default. Consumers have the right to opt out of certain processing activities (sale, sharing, use of sensitive data). No prior consent is required for most processing.
• EU model (opt-in): Data processing requires a lawful basis before it begins. For behavioral advertising, this typically means obtaining affirmative consent before placing cookies or processing personal data.

However, the US opt-out model has an important exception: minors require opt-in consent. CCPA/CPRA mandates that businesses with actual knowledge that a consumer is under 16 must obtain affirmative authorization before selling or sharing their data. For children under 13, parental consent is required. This aligns with the federal Children's Online Privacy Protection Act (COPPA) and creates a significant compliance obligation for ad tech platforms serving content accessible to minors.

4. CCPA vs GDPR: Key Differences

Ad tech companies operating globally must navigate both frameworks simultaneously. The following comparison highlights the critical differences:

5. Other US State Privacy Laws

Following California's lead, multiple US states have enacted comprehensive privacy legislation. As of 2026, the following laws are in effect or enacted:

Virginia Consumer Data Protection Act (VCDPA)

Effective January 1, 2023. Applies to businesses that control or process personal data of at least 100,000 Virginia consumers (or 25,000 with 50%+ revenue from data sales). Requires opt-in consent for processing sensitive data and mandates data protection assessments for processing that presents a heightened risk of harm, including targeted advertising. Enforced by the Virginia Attorney General with a 30-day cure period.

Colorado Privacy Act (CPA)

Effective July 1, 2023. Similar to Virginia's law but with additional requirements: controllers must provide a universal opt-out mechanism, conduct data protection assessments for profiling and targeted advertising, and honor universal opt-out preference signals. The Colorado AG can impose penalties of up to $20,000 per violation. Notably, Colorado requires a data protection assessment specifically for targeted advertising activities.

Connecticut Data Privacy Act (CTDPA)

Effective July 1, 2023. Mirrors many Virginia and Colorado provisions. Includes a right to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. Includes a 60-day cure period through December 31, 2024, which expired, making enforcement more aggressive from 2025 onward.

Additional States

• Utah Consumer Privacy Act (UCPA): Effective December 31, 2023. More business-friendly than other state laws; notably lacks a right to opt out of profiling and does not require data protection assessments.
• Texas Data Privacy and Security Act (TDPSA): Effective July 1, 2024. Broad applicability threshold and includes targeted advertising opt-out rights.
• Oregon, Montana, Florida, Delaware, Iowa, Tennessee, Indiana, and New Jersey: All enacted privacy laws between 2023-2025, with varying effective dates and requirements.
• More states pending: Over 15 additional states have introduced comprehensive privacy legislation as of 2026, signaling a continued state-level regulatory expansion in the absence of a federal privacy law.

6. Compliance Checklist

The following checklist provides a practical framework for ad tech companies navigating US privacy law compliance:

1. Inventory personal data flows: Map all personal information collected, processed, sold, or shared. Identify every vendor, partner, and data recipient in the programmatic supply chain.
2. Implement "Do Not Sell or Share" link: Display the required link prominently on all digital properties. Ensure the opt-out mechanism works across web and mobile environments.
3. Honor GPC signals: Detect and respect Global Privacy Control browser signals as valid opt-out requests. Implement server-side detection of the Sec-GPC HTTP header.
4. Deploy a US privacy CMP: Implement a consent management platform that supports the IAB's US Privacy String specification. Configure it to capture, store, and propagate opt-out preferences through OpenRTB bid requests.
5. Update privacy policies: Disclose all categories of personal information collected, purposes of use, categories of third parties receiving data, and consumer rights. Include the required "Notice at Collection" with specific retention periods.
6. Enable consumer rights requests: Build intake mechanisms (web form, toll-free number) for "know," "delete," and "correct" requests. Implement processes to verify requestor identity and respond within 45 days (extendable by another 45 days with notice).
7. Implement service provider agreements: Execute contracts with all downstream partners classifying them as "service providers" or "contractors" under CPRA, which limits their ability to use shared data for their own purposes and removes the "sale" classification.
8. Conduct risk assessments: For processing that presents significant risk to consumer privacy (including targeted advertising, profiling, and sale of data), conduct and document data protection assessments as required by Virginia, Colorado, and Connecticut laws.
9. Train teams: Ensure that customer support, sales, engineering, and legal teams understand how to handle consumer privacy requests and the operational requirements of each applicable state law.
10. Monitor enforcement: Track CPPA enforcement actions, AG opinions, and regulatory guidance to stay current on compliance expectations.

7. Impact on Programmatic Targeting

US state privacy laws have tangible impacts on programmatic advertising operations:

Reduced Addressable Audience

When California consumers opt out of data sale/sharing, they become invisible to behavioral targeting. Industry estimates suggest that 8–15% of California users exercise their opt-out right, with higher rates among privacy-conscious demographics. Combined with GPC signal adoption, the effective addressable audience for behavioral targeting in California has decreased meaningfully.

Cookie Sync Restrictions

Cookie syncing — the process by which DSPs, DMPs, and data providers match user identifiers across platforms — constitutes "sharing" under CPRA when used for cross-context behavioral advertising. Platforms must either obtain service provider agreements (narrowing the legal characterization) or honor opt-out signals by excluding opted-out users from sync operations.

Shift to Contextual and First-Party Strategies

The combined effect of CCPA/CPRA, state privacy laws, and cookie deprecation has accelerated investment in privacy-compliant targeting alternatives:

• Contextual targeting: Using page content, semantic analysis, and environmental signals rather than user-level behavioral data to target ads.
• First-party data activation: Publishers and advertisers leveraging their own authenticated user data, collected with proper notice and consent, for targeting through direct publisher-advertiser deals and private marketplaces.
• Cohort-based targeting: Privacy-preserving approaches like Google's Topics API that group users into interest cohorts without individual tracking.
• Modeled measurement: Statistical methods for campaign attribution that do not require individual-level conversion tracking.

The US privacy landscape is evolving rapidly, with new state laws taking effect each year and federal legislation remaining a possibility. Ad tech companies that build flexible, privacy-by-design infrastructure today are best positioned to adapt as the regulatory environment continues to shift. The key is treating privacy compliance not as a legal checkbox but as a core engineering and product principle embedded throughout the platform.