CPRA Implementation Guide

CPRA replaced CCPA in California on 1 January 2023, and it changed the shape of what a cookie banner needs to do — it's stricter about sensitive data and it made GPC (Global Privacy Control) a signal you can't ignore. Here's the implementation order, not the statute walkthrough. For the legal detail behind each requirement, see the CPRA Compliance Guide.

The build order

1. Default to opt-out, not opt-in.Unlike GDPR/DPDPA, CPRA doesn't require consent before cookies run — it requires an easy way to say no. Non-essential cookies can fire by default; the obligation is the opt-out mechanism, not gating on opt-in.
2. Add the “Do Not Sell or Share My Personal Information” link. CPRA extended CCPA's “sell” language to explicitly cover “share” (mainly targeting cross-context behavioural advertising). The link text and destination both need updating if you're carrying over an old CCPA implementation.
3. Honour Global Privacy Control automatically.If a browser sends the GPC signal, that has to be treated as a valid opt-out request — for both “sale” and “share” — without the visitor clicking anything.
4. Gate sensitive personal information (SPI) behind opt-in.This is CPRA's biggest departure from plain CCPA: precise geolocation, biometric data, health data, and similar categories need a “Limit the Use of My Sensitive Personal Information” control, opt-in in spirit even though the base model is opt-out.
5. Keep opt-out records with a lookback window.You need to be able to show what a visitor's choice was and when it was made, typically retained across a 12-month cycle for right-to-know requests.

Example — CPRA-strict profile with GPC

import { ConsentiSetup } from '@consenti/ui'

new ConsentiSetup({
  compliance: { type: 'opt-out-strict' }, // CPRA: opt-out + SPI opt-in + Do Not Sell/Share link
  gpc: { mode: 'auto-honour' },            // GPC triggers Do Not Sell AND Do Not Share
})

Consenti's opt-out-strict compliance group models CPRA specifically — distinct from the plainer CCPA opt-outgroup — with the SPI opt-in control and dual Do Not Sell/Share handling built in. It's one way to get this shipped without re-deriving the signal logic yourself.

Verifying it works

1. Load the site with GPC enabled (Brave, or a browser extension) and confirm sale/share cookies never fire.
2. Click the Do Not Sell or Share link and confirm the choice persists across a reload.
3. Trigger the SPI control separately and confirm it doesn't just mirror the general opt-out toggle.
4. Check that a consent/opt-out record is written with a timestamp for each of the above.

Frequently asked questions