CCPA and Web Analytics: What California Privacy Law Means for Your Tracking

TheCalifornia Consumer Privacy Act (CCPA)is a state-level privacy law that went into effect on January 1, 2020. It gives California residents the right to know what personal information businesses collect about them, the right to delete that information, and the right to opt out of its sale. In 2023, the California Privacy Rights Act (CPRA) amended and expanded the CCPA, adding new rights and creating the California Privacy Protection Agency to enforce the law.

For website owners and marketers, the CCPA's impact onccpa website trackingis significant. Traditional analytics tools — particularly Google Analytics — collect IP addresses, device identifiers, cookie data, and browsing behavior that can qualify as “personal information” under the law. If your analytics vendor shares or sells that data (as Google does through its advertising network), you may be on the hook for compliance obligations you didn't realize you had.

The CCPA defines “personal information” broadly: it includes any data that “identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

The CCPA applies tofor-profit businessesthat collect personal information from California residents and meet at least one of the following thresholds:

$25M+ annual revenue

The most commonly triggered threshold. Applies regardless of where your business is headquartered.

100K+ consumers/devices

Buying, selling, or sharing personal information of 100,000+ California residents, households, or devices annually.

50%+ revenue from data

Deriving half or more of annual revenue from selling or sharing California residents' personal information.

Crucially, the CCPA applies based on where yourvisitorsare, not where your business is located. A company in New York, London, or Tokyo that serves California residents and meets any threshold must comply.

If you're already familiar with GDPR-compliant analytics, you might assume the CCPA works the same way. It doesn't. While both laws protect consumer privacy, their approaches differ fundamentally:

The practical takeaway for analytics: under GDPR, you often need a consent bannerbeforeloading any tracking script. Under CCPA, you can load analytics by default — but you must disclose what you collect, honor opt-out requests, and provide a “Do Not Sell My Personal Information” link if your analytics vendor qualifies as selling or sharing data.

The CCPA doesn't ban analytics. It doesn't even require consent before tracking. But it does impose three major obligations on businesses that use analytics tools collecting personal information:

1. Disclosure at collection

Inform California residents what data you collect and whybefore or at the momentyou collect it.

2. Right to opt out

Provide a mechanism for consumers to stop the sale or sharing of their personal information at any time.

3. Right to deletion

Process and fulfill deletion requests within 45 days, including coordinating with your analytics vendor.

You must inform California residentsat or before the point of collectionabout the categories of personal information you collect and the purposes for which it will be used. For analytics, this means your privacy policy must clearly state:

If your analytics tool “sells” or “shares” personal information as defined by CCPA, you must provide a way for users to opt out. The definition of “sale” under CCPA is broad — it includes any exchange of personal information for monetaryor other valuable consideration. If your analytics vendor uses visitor data to improve its own products, train advertising models, or cross-reference with other datasets, that may qualify as a sale.

• What data your analytics tool collects (IP addresses, device info, browsing behavior, cookies, etc.)
• Why you collect it (website improvement, performance monitoring, marketing optimization)
• Whether you share it with third parties and who those parties are
• How long you retain the data

California residents have the right to request deletion of their personal information. If your analytics tool stores identifiable visitor data, you need a process to:

This is where analytics tools that collect no personal information have a massive advantage: if there's nothing identifiable to delete, deletion requests don't apply. No processes to build, no requests to track, no risk of non-compliance.

• Receive and verify deletion requests
• Delete the relevant data from your own systems
• Instruct your analytics vendor to delete it from theirs
• Confirm deletion to the consumer within 45 days

One of the most visible requirements of the CCPA is the mandatory “Do Not Sell or Share My Personal Information” link. If your business sells or shares personal information (including through analytics or advertising tools), this link must appear:

• On your website's homepage, clearly and conspicuously
• In your privacy policy
• In a way that doesn't require the user to create an account to use it

The CPRA amendments extended this to include “sharing” — which covers cross-context behavioral advertising. When a user clicks this link and opts out, you must stop selling or sharing their personal information. For analytics, this typically means either:

The simpler alternative? Use an analytics tool that doesn't sell or share personal information in the first place. If there's nothing being sold or shared, you don't need the link at all.

• Disabling the analytics script entirely for that user
• Switching to a configuration that prevents data from being shared with third parties
• Using the Global Privacy Control (GPC) browser signal, which CCPA recognizes as a valid opt-out mechanism

Not all analytics tools handle CCPA compliance equally. The key question is whether a tool collects “personal information” as defined by the law and whether it sells or shares that data with third parties.

Copper Analyticsis CCPA-compliant by design. It collects no personal information, uses no cookies, stores no IP addresses, and never sells or shares visitor data with anyone. Because no personal information is involved, the CCPA's disclosure, opt-out, and deletion requirements simply don't apply. You get full analytics — including AI crawler tracking and Core Web Vitals — without any compliance burden.

Pro Tip

The easiest path to CCPA compliance isn't building opt-out mechanisms — it's choosing an analytics tool that never collects personal information in the first place. If there's nothing to sell, share, or delete, the law's obligations largely don't apply to your analytics setup.

Whether you're using a privacy-first tool or a traditional analytics platform, here's a step-by-step checklist to ensureccpa analyticscompliance:

Copper Analyticswas built from the ground up with privacy regulations in mind. Rather than retrofitting compliance onto a data-hungry platform, we designed an analytics tool that simply never creates the compliance problem in the first place.

To learn more about our privacy approach, visit our privacy features page.

The CCPA isn't going away, and its influence is growing. Other states — Virginia, Colorado, Connecticut, Utah, and more — have passed their own privacy laws modeled on similar principles. A federal privacy law remains under discussion. The direction is clear: businesses that collect personal information face an ever-expanding web of compliance obligations.

The best part? Privacy-first analytics tools have matured significantly. You no longer sacrifice meaningful insights by choosing privacy. Tools likeCopper Analyticsgive you pageviews, referrers, geolocation, device data, AI crawler tracking, and Core Web Vitals — all without collecting a single piece of personal information.

For more on privacy-first analytics, read our guides on GDPR-compliant analytics, tracking traffic without cookies, and cookie consent banners.