CPRA/CCPA website checklist
A practical list of what a California-facing website usually needs to have in place. Items marked scannable are things our free scan can check automatically; the rest need a person, a lawyer, or both.
- ManualA 'Do Not Sell or Share My Personal Information' link (or equivalent) in your footer
- ScannableYour site honors the Global Privacy Control (GPC) browser signal as an opt-out
- ManualA privacy policy describing what you collect, why, and who it's shared with
- ScannableThird-party advertising/analytics tags don't fire before a visitor has a chance to opt out
- ScannableCookies and local/session storage don't retain identifiers longer than your policy states
- ManualA documented process for handling access, deletion and opt-out requests
- ManualService-provider and vendor contracts include the required CCPA/CPRA terms
Check the scannable items on your site now
What this checklist is not
This is a starting point for a technical review, not legal advice, and it is not a substitute for counsel familiar with CCPA/CPRA and your specific business. Sasquatch Privacy provides technical privacy observations and is not legal advice.
Questions
- Is CPRA the same as CCPA?
- CPRA amended and expanded CCPA — most people now mean the amended law when they say either name. This checklist uses both names because both are still searched for.
- Can a scanner tell me if my site is CCPA compliant?
- No, and we're careful not to claim that. A scanner can verify technical facts — does a tracker fire before opt-out, does the site respond to Global Privacy Control, how long cookies persist. Whether that adds up to compliance depends on your business, your data flows off the website, and your contracts, which a website scan can't see.
- What is Global Privacy Control (GPC) and why is it on this list?
- GPC is a browser signal a visitor can turn on once that tells every site they visit "treat this as an opt-out request." California treats a valid GPC signal as a legally sufficient opt-out on its own, so a site that doesn't act on it technically hasn't honored a visitor's choice — this is one of the few items on this checklist a scan can verify directly.
- Do I need a cookie banner for CCPA/CPRA?
- Not necessarily a banner — the requirement is closer to a clear opt-out mechanism (a link, plus honoring GPC) rather than a specific EU-style consent banner. Conflating the two is a common and expensive mistake; check the technical checklist above, and check with counsel for the legal requirement.
Sasquatch Privacy provides technical privacy observations and is not legal advice.