California’s opt-out model, and the signal you must honour.

European storage-and-access rules and California privacy law ask different questions. The CCPA focuses in part on whether a covered business sells or shares personal information and gives consumers a right to opt out. It does not impose a general prior-consent rule on all cookies; accurate notice, a usable opt-out mechanism and purpose-specific handling of special cases are a common baseline.

The CPRA amendments define “sharing” to cover disclosure for cross-context behavioural advertising, even without payment. Advertising pixels can fall within that definition, but the result depends on the data flow, purpose, contracts and statutory exceptions rather than the vendor name alone.

• Right to opt out of sale and sharing
• Right to limit use and disclosure of sensitive personal information
• Right to know, delete and correct
• No discrimination for exercising a right

California requires businesses to treat an opt-out preference signal as a valid request from that consumer. Global Privacy Control is the signal in practice: the browser sets `navigator.globalPrivacyControl` and sends a `Sec-GPC` header, and the Attorney General’s 2022 settlement with Sephora made clear that ignoring it is an enforcement matter rather than a technicality.

StrongPrivacy honours it where the resolved model is opt-out. When the runtime computes default preferences, a GPC signal of `true` (or the string `"1"`) conservatively disables every optional category before anything loads. The signal is legally directed at sale and sharing rather than all processing, but a category label alone cannot prove which technologies participate in those uses; failing closed avoids letting a sale/share integration run merely because it was filed under analytics, functional, media or a custom category.

This is the most important operational fact on the page. `detectedJurisdiction()` maps US + CA to CCPA and every other US state to no built-in regime. Other states have comprehensive privacy laws with differing definitions, exemptions, sensitive-data rules, appeal processes and universal opt-out requirements. The runtime does not infer those laws; maintain a dated, counsel-reviewed state matrix and express the resulting treatment with region rules.

Express them yourself with region rules. A rule is a country code, an optional region code and a consent model, and a property may carry up to 100 of them. They are evaluated before the profile, so a rule always wins.

"regionRules": [
  { "country": "US", "region": "CA", "model": "opt-out" },
  { "country": "US", "region": "CO", "model": "opt-out" },
  { "country": "US", "region": "CT", "model": "opt-out" },
  { "country": "US", "region": "VA", "model": "opt-out" },
  { "country": "US", "region": "TX", "model": "opt-out" }
]

A single US-wide opt-out rule can simplify the interface, but it is not a substitute for a state-law analysis. An opt-out model does not by itself address differences in sensitive-data consent, children’s data, profiling, notices, appeals or the definition of sale and targeted advertising.

• California Department of Justice: CCPA

  Regulator guidance

  Checked 2026-09-19

• Global Privacy Control specification

  Official documentation

  Checked 2026-09-19