California Consumer Privacy Act (United States)
What the CCPA covers, and what it means for your website analytics
Official name: California Consumer Privacy Act of 2018 (CCPA). In force since 1 January 2020 and expanded by the CPRA from 2023, it gives California residents rights over the personal data businesses collect about them.
See all privacy lawsAt a glance
California's consumer privacy law
The CCPA works on an opt-out model. Businesses can collect personal information, but they must say what they collect and why, and let people stop its sale or sharing.
Californians can also ask to see, correct or delete their data and limit the use of sensitive information, and businesses can't treat them worse for doing so.
Who it covers
California businesses with $26.6M+ revenue, or that trade data on 100,000+ people
What it means for websites
Cookies and IP addresses count as personal information, with limited exceptions
Who enforces it
The California Privacy Protection Agency and the California Attorney General
Maximum fines
Up to $7,988 per intentional violation or one involving under-16s (2025 figure)
Further reading
Everything you need on this law
The CCPA
The current text of the California Consumer Privacy Act, as amended by the CPRA, in the California Civil Code.
Read the official textThe Attorney General’s CCPA guide
California’s Attorney General explains the rights the CCPA gives consumers and what businesses must do.
Read the guideCalifornia Privacy Protection Agency
The agency that writes the CCPA regulations and enforces them, with FAQs for businesses.
Read the FAQsThe Colorado Privacy Act
Colorado’s privacy law, triggered by how many residents’ data a business processes.
Read our CPA guideThe Virginia Consumer Data Protection Act
Virginia’s privacy law, with no revenue threshold, enforced only by the Attorney General.
Read our VCDPA guideMore privacy laws
Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.
See all privacy lawsTWIPLA and the CCPA
Analytics that collect as little as possible
TWIPLA’s default Maximum Privacy Mode is designed to align with the CCPA. You get the insights you need, from far less data than typical analytics tools collect:
- No cookies and no fingerprinting
- IP addresses are used for an approximate location, then discarded
- No visitor profiles: reports show trends across your audience, never one person’s page history
- All data is hosted in Germany, under a Data Processing Agreement that lists every subprocessor
- An optional opt-out link lets visitors switch off TWIPLA tracking entirely
Want more detail for US visitors? Custom Country Data lets you choose a different privacy mode for them. Whichever mode you use, describe TWIPLA in your privacy policy.
Proof, not promises
How TWIPLA aligns with the CCPA
Privacy modes and country settings
How to choose one of four privacy modes, and set a different one for visitors by country.
Read the guideVisitor opt-out
Where any visitor can switch off TWIPLA tracking for themselves, at any time.
See the opt-outWhat to put in your privacy policy
Ready-to-use wording for describing TWIPLA in your privacy policy.
Get the wordingOur Data Processing Agreement
The processing agreement every TWIPLA customer signs, with all subprocessors listed.
Read the agreementInsight Enterprises
How a Fortune 500 IT leader sees 100% of its traffic across every domain, with built-in CCPA compliance.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
