CPRA Implementation Guide
CPRA replaced CCPA in California on 1 January 2023, and it changed the shape of what a cookie banner needs to do — it's stricter about sensitive data and it made GPC (Global Privacy Control) a signal you can't ignore. Here's the implementation order, not the statute walkthrough. For the legal detail behind each requirement, see the CPRA Compliance Guide.
The build order
- Default to opt-out, not opt-in.Unlike GDPR/DPDPA, CPRA doesn't require consent before cookies run — it requires an easy way to say no. Non-essential cookies can fire by default; the obligation is the opt-out mechanism, not gating on opt-in.
- Add the “Do Not Sell or Share My Personal Information” link. CPRA extended CCPA's “sell” language to explicitly cover “share” (mainly targeting cross-context behavioural advertising). The link text and destination both need updating if you're carrying over an old CCPA implementation. Consenti provides the button/action — placing it somewhere a visitor can actually find (a footer link or equivalent) is the site owner's job, not something Consenti auto-injects.
- Honour Global Privacy Control automatically.If a browser sends the GPC signal, that has to be treated as a valid opt-out request — for both “sale” and “share” — without the visitor clicking anything.
gpcModeonly takes effect once the widget itself has initialized; if a tag-loading script sits earlier in<head>, usebuildSyncGpcSnippet()(from@consenti/ui) to freeze Google Consent Mode v2 to denied synchronously, ahead of everything else — see the GPC config reference for the full snippet and<head>ordering. - Gate sensitive personal information (SPI) behind opt-in.This is CPRA's biggest departure from plain CCPA: precise geolocation, biometric data, health data, and similar categories need a “Limit the Use of My Sensitive Personal Information” control, opt-in in spirit even though the base model is opt-out. Colorado's CPA has the same expectation for its own
opt-outstates — Consenti models that as a per-regionrequiresSensitiveOptIncarve-out rather than a separate compliance group; see the CCPA/CPRA guide for how it's wired. - Keep opt-out records with a lookback window.You need to be able to show what a visitor's choice was and when it was made, typically retained across a 12-month cycle for right-to-know requests.
💡Migrating from CCPA? The two things most implementations miss are the “share” wording update and the separate SPI opt-in control — both are CPRA additions that a CCPA-only banner won't have.
Example — CPRA-strict profile with GPC
consent.ts
typescript
import { ConsentiSetup } from '@consenti/ui'
new ConsentiSetup({
compliance: { type: 'opt-out-strict' }, // CPRA: opt-out + SPI opt-in + Do Not Sell/Share link
gpc: { mode: 'auto-honour' }, // GPC triggers Do Not Sell AND Do Not Share
})Consenti's opt-out-strict compliance group models CPRA specifically — distinct from the plainer CCPA opt-outgroup — with the SPI opt-in control and dual Do Not Sell/Share handling built in. It's one way to get this shipped without re-deriving the signal logic yourself.
Verifying it works
- Load the site with GPC enabled (Brave, or a browser extension) and confirm sale/share cookies never fire.
- Click the Do Not Sell or Share link and confirm the choice persists across a reload.
- Trigger the SPI control separately and confirm it doesn't just mirror the general opt-out toggle.
- Check that a consent/opt-out record is written with a timestamp for each of the above.
Related documentation