A CCPA cookie banner gives California visitors notice at or before collection and an easy opt-out from the sale or sharing of their data, because the CCPA works on opt-out where the GDPR waits for a yes. The site honors a “Do Not Sell or Share My Personal Information” link and the Global Privacy Control signal. You set it up with one tag in <head>, a California region rule, a footer link, and a consent log check.
What a CCPA cookie banner has to do
A CCPA cookie banner has three jobs, and a client site that does only one or two of them isn’t compliant. First comes notice at collection, which means that at or before the point where the site collects personal information, the visitor learns the categories of information collected, the purposes, and whether the business sells or shares it, with a pointer to the privacy policy.
The second job is a Do Not Sell or Share opt-out that stands apart from the banner buttons, so a visitor who closed the banner can still opt out later from a link on the page. Its current wording is “Do Not Sell or Share”, because the CPRA amendments added sharing to the old “Do Not Sell” right.
The third job is to treat Global Privacy Control as a valid opt-out. When a visitor’s browser sends the GPC signal, the site honors it as an opt-out with no extra confirmation step.
“Sharing” covers cross-context behavioral advertising, so a client site that runs Meta Pixel or Google Ads remarketing is in scope even when no money changes hands. When a visitor sends GPC, the banner skips the prompt, records a reject, sets the Do Not Sell flag, and shows a short notice. The same client site often has EU visitors too, and they fall under a different law, so you set the banner’s rules by region and not once for the whole site.
What you need before you start
Collect four things before you open anything, because the footer link in step 3 and the deploy in step 5 can’t go ahead without them:
- A ConsentLayer organization on Solo or above. Solo adds the modal template, branding removal, weekly automatic scans, region rules (GDPR, CCPA, LGPD, and custom groups), Do Not Sell request handling, and unlimited banner languages.
- Access to the client site’s
<head>and footer, or an agent that can edit and deploy its code. - The client’s privacy policy URL, because the Do Not Sell or Share link goes next to it in the footer and inside the policy.
- The name of the client contact who’ll process Do Not Sell or Share requests.
That last item is the one that gets skipped. I ask for a name at the kickoff call, because a request that nobody owns sits unprocessed until a complaint arrives.
You can set up the site with one prompt to the AI you already use, or from the dashboard at app.consentlayer.com.
Set up the CCPA cookie banner step by step
Step 1: Scan the client site and create it in ConsentLayer
Prompt: “Set up ConsentLayer for <client-domain>”
What happens: setup_site is one tool call that creates the site, scans it, configures consent categories, and returns the install snippet with a real project key. If you haven’t connected your agent yet, you can set it up from your agent and sign in through your browser the first time.
Without an agent: sign in at app.consentlayer.com, add the client site, and start a scan.
Expected result: a list of the trackers on the site, sorted into categories, and an install snippet you’ll paste in step 5.
Step 2: Add the CCPA region rule for California
Prompt: “Add the CCPA region rule for California on <client-domain>”
Your agent adds a region rule for California, and region rules can target the EU/EEA and UK block, 65 countries, and 51 US states including DC (Solo and up), so you can widen the rule later when the client’s privacy counsel names more states.
Without an agent: open the site in the dashboard, go to its region rules, and add a CCPA group that targets California.
Expected result: the site’s region rules list a CCPA group that targets California.
Step 3: Put the Do Not Sell or Share link in the footer
The link text is “Do Not Sell or Share My Personal Information”, or “Your Privacy Choices” with the opt-out icon next to it. Place it in the homepage footer next to the privacy policy link, and add the same link inside the privacy policy.
The wording and icon rules are in the Do Not Sell link and the opt-out signal.
Without an agent: edit the footer in the client’s theme or site builder yourself, and save the change to every page that uses that footer.
Expected result: the link shows in the footer on every page and appears inside the privacy policy.
Step 4: Keep Global Privacy Control on
Prompt: “Confirm Global Privacy Control is honored on <client-domain>”
When a visitor sends GPC, the banner skips the prompt, records a reject, sets the Do Not Sell flag, and shows a short notice. Leave this on even for a client who asks for fewer notices, because the CCPA counts GPC as a valid opt-out and the reject in the log is your proof it was honored.
Without an agent: open the site’s behavior settings in the dashboard and confirm GPC handling is on.
Expected result: a visitor with GPC turned on sees a short notice in place of the banner, and the site treats them as opted out.
Step 5: Paste the tag in <head> and deploy
Paste the install snippet from step 1 as the first script in <head> on every page. The tag must load synchronously, with no defer and no async, before other scripts. Do this step last, because then the first banner a real visitor sees already has the California rule and the footer link behind it.
<head>
<script src="(paste the src from your install snippet)"></script>
</head>After you deploy, check that no optimizer or tag plugin adds defer or async to the tag on its next run.
Expected result: the banner shows on the live client domain.
Check that it works for a California visitor
Prompt: “Check the installation on <client-domain>”
check_installation fetches the live homepage and confirms the tag is in <head> without defer or async.
Without an agent, open the live site, view the page source, and confirm the tag is the first script in <head>. Then turn GPC on in your own browser, reload the site, and open the consent log to find your own visit with a reject recorded.
That record is what you show the client when they ask “does the site honor opt-outs”, and it’s more convincing than a screenshot of a settings page. The guide on how Global Privacy Control shows up in the consent log walks through each field you’ll see.
Common problems and fixes
A tracker fires before the visitor chooses
This happens when the service library doesn’t recognize a script, so nothing holds it. Scripts the library does not recognize go to a review queue, where they are approved with a category and blocking rule, or dismissed. Approve this one with the Marketing category and a blocking rule, then reload the page with the browser network tab open and confirm the request doesn’t leave before you click.
Fix this problem before any other on the list, because CIPA demand letters under California’s wiretapping law target pixels that fire before the banner.
Every visitor sees the same banner
Region rules are not on the Free plan, and Free shows one banner to all visitors. Move the site to a plan with region rules and repeat step 2, then reload from a California address to confirm the rule applies.
Going further
Add the GDPR region rule the same way you added the CCPA one in step 2, so the client’s EU visitors are covered by their own rule on the same site.
Run a new scan whenever the client adds a pixel, a chat widget, or an embed. Known trackers are held by built-in patterns, but a script the library doesn’t recognize isn’t, and a fresh scan is how you find the new one before it fires on a live visitor. For a roster of client sites, the overview of cookie consent for client sites covers how agencies run this across many domains.
CCPA cookie banner FAQ
Does the CCPA require an EU-style cookie banner?
No. Each site can use opt-in, which is the default, or opt-out. For a client whose audience is in the US, switching the site to opt-out matches the CCPA model, and keeping the default is the safer choice when you can’t say where the traffic comes from.
Does Google Consent Mode work with a CCPA cookie banner?
Yes. Essential maps to functionality and security storage, Statistics to analytics_storage, and Marketing to ad_storage, ad_user_data, and ad_personalization. Check that the client’s Google tags read these signals, because a tag that ignores Consent Mode keeps running on its own rules.
How do you show a client that the site honored an opt-out?
Open the visitor’s record in the consent log, which holds the visitor ID, country, jurisdiction, categories, per-service decisions, GPC and Do Not Sell flags, consent version, anonymized IP, user agent, locale, template, geo group, and a link to a snapshot of the banner version the visitor saw.
Can you reuse the same CCPA setup on the next client site?
Yes. You can export a site’s full configuration as JSON and import it into another site, including design, behavior, categories, services, cookies, translations, and geo groups. Run a scan on the next site after the import, because its trackers differ from the first one’s.
How ConsentLayer handles CCPA on client sites
ConsentLayer holds trackers until consent and records every decision, so a client site is protected once the tag is live in <head> on the real domain, blocking is on, and decisions are recorded. The part that saves time on a roster is the score: ask your agent “What’s the compliance score for <client-domain>?” and you get a score out of 100, with the open items named, which tells you what’s left before you hand the site over.
Plan limits work by pooled pageviews on Studio and Agency, so one pageview allowance covers every site in the organization and a quiet client site doesn’t waste its share. Run the score again after you fix each open item, and stop when nothing is left on the list.
Set up your first client site with a CCPA region rule and the tag in <head> by following the ConsentLayer quickstart.