In short
The California Consumer Privacy Act, amended and expanded by the California Privacy Rights Act, gives California residents rights over their personal information, including the right to know what is collected, the right to deletion, and the right to opt out of the sale or sharing of their data. For an ad stack, the operative requirement is opt-out signal handling: when a resident opts out, that choice has to reach every downstream system that would otherwise share their data with a platform. CPRA added a dedicated enforcement agency and tightened the rules around sharing for cross-context behavioral advertising, which is precisely the activity most ad pipelines perform. Compliance therefore looks less like a legal checkbox and more like a data-flow design, because the stack needs to recognize an opt-out and suppress the affected identifiers before they are delivered. The same per-event consent and suppression that GDPR demands covers the CCPA and CPRA obligations for California traffic.
How it differs from GDPR
GDPR runs on opt-in consent; CCPA and CPRA run on opt-out rights. The CPRA’s addition of “sharing” for cross-context behavioral advertising put ad-platform data flows squarely in scope, which is why US stacks carry opt-out flags on every event.
What compliance looks like in practice
An honored Global Privacy Control signal, opt-out flags that ride each server-side event, and processor terms with every vendor that touches personal information.
How does an opt-out flow through the stack?
A California shopper opts out of data sharing. A compliant pipeline flags that choice and stops sending their hashed identifiers to ad platforms, while continuing to measure users who have not opted out.