22 Oct 2026 Search

Some jurisdictions have consent-based privacy laws.

Some juristictions have opt-outs.

And then there’s California. We have both. For CIPA you need consent, for CCPA you have to handle opt-outs, including Global Privacy Control (GPC).

Sites are going through the five stages of CIPA getting this stuff set up right. A few have it down, while others, not so much.

Some of the site features that are set up to comply with one law are creating problems under the other.

The right way

Here’s how to get compliance with both, with minimal risk and hassle for the user. Developing this now will save a lot of boring but high-stakes compliance meetings.

  1. Check for a consent cookie. If it’s on, go to step 6.

  2. Check GPC. If it’s on, go to step 7.

  3. Show the consent dialog, along with CCPA and CalOPPA required features such as link to privacy policy.

  4. Is Rewarded Interest running? Rewarded Interest suppresses the consent dialog and shares CMAID. Go to step 6.

  5. User makes a choice. If the user declines consent, go to step 8.

  6. Set or refresh the consent cookie. Load cross-context tracking scripts. END.

  7. Acknowledge the user’s GPC in the page footer.

  8. Continue without cross-context tracking scripts. END.

Seven steps looks like a lot at first, but look, we only have two END states, and the only people who have to see the consent dialog are first-time visitors with neither GPC nor Rewarded Interest.

One more step that has to happen when the user transitions from a logged-off to a logged-in state. Check for the consent cookie, and if it’s not present, then flag the user’s record in the CRM system as “do not sell or share”. That’s basically a CCPA thing.

Somewhere around the whole consent rigamarole is going to be an opportunity to promote Rewarded Interest to likely prospects. That would give them a better experience in future. (Likely GPC users are already getting that option promoted to them by the privacy scene.)

And of course some pages have to work without third-party tracking at all (such as the privacy policy and ToS pages. You can’t block the privacy policy page with a consent dialog.)

Wrong: break CCPA compliance trying to do CIPA

All of the wrong ways are basically do a bunch of extra compliance tickets and create a bunch of extra risks. And they’re more complicated than the seven steps above. TODO: learn Mermaid so I can diagram how hairy some of these are.

The first wrong way is CIPA consent UX that blocks the CCPA and CalOPPA required features. We don’t just have two privacy laws here, we have two parallel systems but way more than two laws. Don’t forget the Online Privacy Protection Act of 2003 (CalOPPA).

You can’t block people from the CCPA/CalOPPA stuff just to get them to do the CIPA stuff first. All the compliance stuff has to work together.