What is CCPA and how does it affect advertising?
The California Consumer Privacy Act (CCPA), expanded by the CPRA, gives California residents the right to know what personal data businesses collect, to delete it and to opt out of its "sale" or "sharing", including for cross-context behavioral advertising. Ad-supported businesses must honor opt-outs, including browser signals like Global Privacy Control, and pass them down the ad chain.
Unlike GDPR's opt-in model, CCPA / CPRA is mostly opt-out: ads can be targeted until a person says no. Websites must offer a "Do Not Sell or Share My Personal Information" link and honor the Global Privacy Control signal. California's privacy agency and attorney general have brought enforcement actions over failures to process opt-outs.
Many other US states have passed similar laws, which is why the IAB Tech Lab created the IAB Global Privacy Platform to carry state-specific signals. Companies also look at data minimization and pseudonymous data strategies to reduce risk.