CCPA Consent Requirements in 2026: What Actually Needs Consent

If you are searching ccpa consent requirements on August 18, 2026, the first useful reset is this: California usually does not begin with a blanket rule that every adult visitor must click Accept before any non-essential data practice can happen.

For most adults, the California Consumer Privacy Act is still built more around notice, the right to opt out of sale or sharing, the right to limit certain sensitive-personal-information uses, and the obligation to honor qualifying browser signals such as Global Privacy Control. But ccpa consent requirements still matter in specific places, especially where minors are involved, where a business wants to resume sale or sharing after an opt-out, or where a company tries to rely on consent collected through a manipulative interface.

If you want the adjacent website context first, start with our guides to CCPA cookie consent requirements, California consumer privacy, and cookie consent requirements. This article is narrower. It is about what ccpa consent requirements actually mean in practice in 2026.

The short answer on CCPA consent requirements

The fastest accurate summary of ccpa consent requirements in 2026 is:

• adults usually get opt-out rights, not a universal opt-in rule;
• covered businesses still need clear notices and a usable privacy-choice path;
• qualifying opt-out preference signals such as GPC must be honored;
• consumers under 16 move the analysis into real opt-in territory for sale or sharing;
• sensitive personal information usually triggers a right to limit, not a blanket consent-first rule;
• and consent gathered through dark patterns may not count at all.

That is why many California implementations fail in the gap between interface language and live behavior. The banner may say one thing while the account system, app SDKs, ad-tech vendors, or browser-signal handling do another.

1. Start with opt-out, not a universal adult opt-in rule

This is where many teams still import the wrong model from Europe.

California Civil Code section 1798.120 gives consumers the right to direct a business that sells or shares personal information not to sell or share it. That is an opt-out right. The CPPA FAQ says businesses cannot sell or share personal information after they receive that request unless the consumer later consents to the sale or sharing.

So for many adult-user scenarios, ccpa consent requirements are really about what happens after the user says no, not about forcing an advance Accept click before all collection begins. That distinction matters for ad-tech, retargeting, audience building, and other flows where teams often overfocus on banner appearance and underfocus on the downstream stop signal.

2. Give users a real notice and a real choice path

California still expects people to be told what is happening and how to act on it.

The CPPA FAQ says consumers have the right to be notified of the categories of personal information a business collects and what it does or may do with that information. The same FAQ says that, in most instances, businesses also must provide a clear and conspicuous link labeled “Do Not Sell or Share My Personal Information,” “Your Privacy Choices,” or “Your California Privacy Choices” in the header or footer when the right applies.

That makes ccpa consent requirements partly a notice architecture problem. A hidden footer maze, a vague privacy policy, or a choice flow that only works on one surface is still risky even if the company believes it has the legal theory right.

On a live review, I would check:

1. whether the privacy policy matches the actual data flows;
2. whether the privacy-choice link is easy to find on web and mobile;
3. whether the opt-out route works without forcing unnecessary extra steps;
4. whether the business can prove the choice reached the systems that matter.

3. Treat Global Privacy Control as a technical requirement, not a nice extra

This is one of the clearest current California signals.

The California DOJ still describes Global Privacy Control as a “stop selling or sharing my data switch.” The CPPA FAQ says businesses must honor qualifying opt-out preference signals, such as GPC, as valid requests to opt out of sale or sharing. The same FAQ says businesses generally must comply with opt-out or limit requests as soon as feasibly possible, up to a maximum of 15 business days.

For ccpa consent requirements, that means browser signals are not just policy garnish. They are part of the live control path. If a site or app stack only partially respects the signal, or only respects it on one browser or one service surface, the implementation may still fail in practice.

4. Minors under 16 are where real opt-in consent becomes unavoidable

If your team wants the cleanest answer to when California actually requires consent, this is it.

Section 1798.120 says a business shall not sell or share the personal information of consumers it knows are under 16 unless the consumer, if they are at least 13 and under 16, or the parent or guardian, if the consumer is under 13, has affirmatively authorized that sale or sharing. The DOJ’s privacy-enforcement page says California’s 2025 Jam City settlement required the company not to sell or share the personal information of consumers at least 13 and less than 16 years old without first obtaining their affirmative opt-in consent.

That is why ccpa consent requirements cannot be reduced to one adult website banner rule. For minors, California is much closer to an actual consent-first structure.

5. Sensitive personal information usually means a right to limit, not blanket opt-in

This is another place where teams often flatten distinct rights together.

Section 1798.121 gives consumers the right to limit the use and disclosure of sensitive personal information in certain circumstances. Section 1798.135 says businesses using or disclosing sensitive personal information beyond the statute’s allowed purposes must provide a clear and conspicuous link such as “Limit the Use of My Sensitive Personal Information,” or a combined privacy-choices link.

So when teams ask about ccpa consent requirements for sensitive data, the more precise California question is often whether the business has created the required limitation path and honored it correctly, not whether it has built a universal consent gate for every adult interaction.

6. Dark patterns can wipe out the consent you think you collected

This is where “consent” becomes less about button color and more about legal validity.

The CPPA’s 2024 enforcement advisory says businesses must present privacy choices in a clear and balanced way and warns that interfaces that impair autonomy, decision-making, or choice may be dark patterns. Michael Macko put the operational point plainly: “Dark patterns aren’t about intent, they’re about effect.” The CCPA regulations effective January 1, 2026 go further and say that agreement obtained through dark patterns does not constitute consumer consent.

That matters directly to ccpa consent requirements. If a business tries to rely on consent to keep selling or sharing after an opt-out, to process a minor’s data for sale or sharing, or to ignore an opt-out preference signal through a consent page, the interface design cannot be manipulative.

7. Current enforcement is testing whether the choice actually reaches every relevant surface

California enforcement is increasingly runtime and cross-system, not cosmetic.

The DOJ’s privacy-enforcement page says Disney paid $2.75 million in February 2026 after California alleged the company failed to fully effectuate opt-out requests across Disney+, Hulu, and ESPN+ and limited GPC handling to the specific device in use. The same enforcement page says Jam City paid $1.4 million in 2025 over missing in-app opt-outs and failures involving minors’ data.

The practical lesson is simple: ccpa consent requirements are not satisfied when one page records a choice but connected services, devices, apps, or embedded vendors continue the same sale or sharing behavior anyway.

A practical review sequence for this week

If I were reviewing ccpa consent requirements for a live business right now, I would do it in this order:

1. identify whether the real issue is sale or sharing, sensitive-personal-information use, minors’ data, or all three;
2. verify notice-at-collection and privacy-policy disclosures against the actual stack;
3. test the visible opt-out or privacy-choices path on web and mobile;
4. test qualifying GPC handling in a clean browser session;
5. confirm minors’ sale or sharing paths truly require affirmative authorization;
6. review whether any interface choice looks asymmetric or manipulative;
7. verify the signal reaches downstream vendors, connected products, and account-linked surfaces;
8. document what happened so support, legal, and engineering can all reconstruct it later.

That sequence usually reveals more than debating whether the homepage banner looks compliant.

Bottom line

In 2026, ccpa consent requirements are narrower than many teams assume, but they are not lighter.

For adults, California is still more about notice, opt-out, GPC, and practical control over sale or sharing than a blanket opt-in model. But the consent pieces that remain are serious: minors’ sale or sharing, post-opt-out reauthorization, and any situation where the business claims a person meaningfully agreed. If those paths are confusing, partial, or broken across services, the compliance story is weaker than the interface suggests.

Sources

• California Privacy Protection Agency FAQ
• California Privacy Protection Agency: Law & Regulations
• California Civil Code section 1798.120
• California Civil Code section 1798.121
• California Civil Code section 1798.135
• California DOJ: Global Privacy Control
• California DOJ: Privacy Enforcement Actions
• CPPA Enforcement Advisory on Dark Patterns
• CCPA statute and regulations effective January 1, 2026

This post was updated on August 18, 2026 using current official California legal, regulatory, and enforcement materials available at publication time.