← Industry guides
E-commerce brands
CCPA requirements for e-commerce brands
Brands that buy, sell, or share personal information of 100,000 or more California consumers or households are covered regardless of revenue. Paid-social pixels are usually where “sharing” happens.
Sharing, pixels, and opt-outs
The CCPA defines “sharing” to include disclosing personal information for cross-context behavioral advertising. Pixels from ad platforms that build audiences across sites are the typical example — which is why the opt-out has to actually stop them.
What to verify every month
Store platforms ship app and theme updates continuously, so a one-time setup drifts.
- The “Do Not Sell or Share” or “Your Privacy Choices” link is present on storefront, checkout, and account pages (Civ. Code §1798.135).
- A Global Privacy Control signal suppresses ad pixels, not just a banner (11 CCR §7025).
- New apps and theme changes haven't added untracked tags.
- The privacy policy has been updated within 12 months (Civ. Code §1798.130(a)(5)).
Primary sources
- CCPA statute text (Civ. Code §1798.100 et seq.), effective Jan 1, 2026 — cppa.ca.gov
- CPPA — California Consumer Privacy Act Regulations (Cal. Code Regs., tit. 11, §7000 et seq.)
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.