CCPA / US State Privacy Laws Guide

Consenti supports opt-out Compliance Groups required by CCPA, VCDPA, CPA, CTDPA, TDPSA, and similar US state laws.

Official references

• California Attorney General — CCPA page
• Cal. Civ. Code § 1798.100 — CCPA statute text
• Global Privacy Control (GPC) specification

Opt-out model vs. GDPR opt-in

Enabling CCPA mode

createConsenti({
  compliance: { type: 'opt-out' },
})

In your frontend widget:

new ConsentiSetup({
  compliance: { type: 'opt-out' },  // sets all cookies to 'granted' on first load, GPC denies sale/sharing
})

GPC — Global Privacy Control

The GPC signal (navigator.globalPrivacyControl === true) is treated as an opt-out under CCPA (required by California AG guidance). The opt-out and opt-out-strict compliance groups already default to gpcMode: 'honor' — set the profile's gpcMode to 'strict' (via profileOverride or the dashboard) for silent denial instead of showing the GPC banner variant:

1. Widget detects GPC signal
2. Automatically denies all listenGpc: true cookies
3. Writes consent record immediately without showing banner
4. gpc_detected: true is stored on the consent record

"Do Not Sell" / Opt-out button

Add a '!' button to let users opt out at any time:

{
  "text": "Do Not Sell My Data",
  "style": "secondary",
  "action": "custom",
  "cookies": "!"
}

The '!' action sets all non-mandatory cookies to 'denied' and writes the consent record.

State-by-state coverage

Colorado's sensitive-data carve-out

Colorado's CPA requires opt-in consent for sensitive data specifically, even though the rest of the opt-out group defaults to granted. Consenti models this as a per-region override — Colorado stays in the opt-out group (same banner behavior, same GPC handling as every other state above), but any cookie tagged cpraCategory: 'sensitive' defaults to denied specifically for visitors resolved to Colorado.