22 Oct 2026 Search

Some jurisdictions have consent-based privacy laws.

Some jurisdictions have opt-outs.

And then there’s California. We have both. For CIPA you need consent, for CCPA you have to handle opt-outs, including Global Privacy Control (GPC).

Sites are going through the five stages of CIPA getting this stuff set up right. A few have it down, while others, not so much.

Some of the site features that are set up to comply with one law are creating problems under the other.

The right way

Here’s how to get compliance with both, with minimal risk and the least possible hassle for the user. Developing this now (or realistically not now now, it is Q4) will save a lot of boring but high-stakes compliance meetings.

  1. Check for a consent cookie (or a logged-on user who has already consented). If consent is on, go to step 6.

  2. Check GPC. If it’s on, go to step 7.

  3. Show the consent dialog, along with CCPA and CalOPPA required features such as link to privacy policy.

  4. Is Rewarded Interest running? Rewarded Interest suppresses the consent dialog and shares CMAID. Go to step 6.

  5. User makes a choice. If the user declines consent, go to step 8.

  6. Set or refresh the consent cookie. Load cross-context tracking scripts. END.

  7. Acknowledge the user’s GPC in the page footer.

  8. Continue without cross-context tracking scripts. END.

Eight steps looks like a lot at first, but look, we only have two END states, and the only people who have to see the consent dialog are visitors with neither GPC nor Rewarded Interest.

One more step that has to happen when the user transitions from a logged-off to a logged-on state, or if they arrive with a valid session cookie that identifies them. Check for the consent cookie, and if it’s not present, then flag the user’s record in the CRM system as “do not sell or share”. That’s basically a CCPA thing. You can’t just do opt-outs as a front-end task, they have to affect server-to-server traffic, too. And if the user changes their profile to allow tracking, set the consent cookie when they log in.

Update: For CIPA you need to get “consent to wiretapping” that is acceptable to a California jury. The weak EU-style “consent” to data processing that Irish regulators tolerate is not really useful here. Don’t re-use GDPR design or copy for CIPA. (It is often easier to reform a problematic data practice than to try to explain it in a way that’s clear enough to get meaningful consent to it.)

Somewhere around the whole consent rigmarole is going to be an opportunity to promote Rewarded Interest to people who would likely want it. That would give them a better experience in future. (Likely GPC users are already getting that option promoted to them by the privacy scene.)

And of course some pages have to work without third-party tracking at all (such as the privacy policy and ToS pages. You can’t block the privacy policy page with a consent dialog.)

So that’s the right way, what about some…interesting…CIPA/CCPA mash-ups?

In California you have the right to hire a CCPA lawyer and a CIPA lawyer who don’t speak to each other, I guess

Wrong: break CCPA compliance trying to do CIPA

All of the wrong ways are basically do a bunch of extra compliance tickets and create a bunch of extra risks. And they’re more complicated than the steps above. TODO: learn Mermaid so I can diagram how hairy some of these are.

The first wrong way is CIPA consent UX that blocks the CCPA and CalOPPA required features. We don’t just have two privacy laws here, we have two parallel systems but way more than two laws. Don’t forget the Online Privacy Protection Act of 2003 (CalOPPA).

You can’t block people from the CCPA/CalOPPA stuff just to get them to do the CIPA stuff first. All the compliance tickets have to take into account the work done on the other compliance tickets.