CCPA cookie banner requirements: the opt-out link, the Global Privacy Control signal and equal choices

CCPA cookie banner requirements: what the text says

California's CCPA regulations say a notification or tool about cookies, such as a cookie banner or cookie controls, is not by itself an acceptable method for submitting opt-out requests (section 7026(a)(4)). Their reason is that cookies concern collecting personal information, not selling or sharing it. So the requirements sit elsewhere: an opt-out link or signal route, handling of signals, a display that it worked, and equal choices.

This page is informational and is not legal advice. CookieYes is a technology platform that assists with compliance, each site owner is responsible for their own, and a qualified lawyer answers whether your business sells or shares personal information. The texts and CookieYes figures are as read on October 31, 2026.

The Do Not Sell or Share link, or a signal instead

The statute asks a business that sells or shares personal information for a clear and conspicuous homepage link titled "Do Not Sell or Share My Personal Information" (Civil Code 1798.135(a)(1)). The business need not comply with that link rule if it allows consumers to opt out through an opt-out preference signal (1798.135(b)(1)). Section 7026(a)(1) of the regulations adds that an online business must allow opt-out requests through such a signal.

Honoring Global Privacy Control and showing it

Global Privacy Control (GPC) is a browser signal meant to communicate a Do Not Sell or Share request under the CCPA. The Attorney General says GPC is available in browsers such as Firefox, DuckDuckGo and Brave, or as a browser extension.

A business that sells or shares personal information processes a qualifying signal as a valid opt-out request (section 7025(b)) and displays whether it processed the consumer's opt-out (7025(c)(6)). A business that does not sell or share need not treat the signal as a request (7025(c)(1)).

One limit: the CPPA's regulations page lists a rulemaking on opt-out preference signals whose preliminary comment period closed on April 6, 2026, so that rule is still at a preliminary stage.

Equal choices and no tricks in the design

Section 7004 of the regulations says the path to a more privacy-protective option must not be longer, harder or more time-consuming than the path to a less protective one. Its banner example: only "Accept All" beside "More Information" or "Preferences" is not an equal choice, while "Accept All" and "Decline All" is. A consumer's silence or failure to act affirmatively does not constitute consent.

GDPR and CCPA on one banner

CookieYes sells the two rule sets as templates. GDPR is opt-in: no non-essential cookies until the visitor agrees. US State Laws is opt-out: cookies run until the visitor refuses. Both are on all four plans. The combined GDPR and US State Laws template is listed from Pro, as is geo-targeting (showing one banner to some regions and another to others), and CookieYes's help article says showing both banners on one site is a Pro and Ultimate feature.

Testing that the opt-out works

1. Clear the site's data, including third-party cookies, in your browser's developer tools.
2. Hard refresh the page with Ctrl+Shift+R.
3. Read the cookie list: CookieYes's article says only strictly necessary cookies should be present until you accept the banner.
4. Open the consent log, where CookieYes records each choice with a consent ID, country, status, time and proof of consent.

CookieYes's US State Laws opt-out template is on all four plans, and its Respect Global Privacy Control switch, for the signal California's rules ask a business that sells or shares data to honor, starts on Pro at $25 a month per domain, billed monthly. Pro starts with a 14-day trial; the pricing FAQ says the card is charged automatically when it ends unless you cancel.

See CookieYes pricing for every plan, do I need a cookie banner in the US for the wider question and best cookie consent banner for rivals.