Opt out, not opt in
Outside opt in regions Velo starts opt out: your tags can run, and visitors can reject ads and tracking from the banner at any time.
California opt outs,
respected by default.
The CCPA, as amended by the CPRA, gives Californians the right to opt out of the sale or sharing of their personal information. Velo gives them that choice and honours Global Privacy Control.
The rule,
at a glance.
General information, checked September 2026. Not legal advice.
- Applies to
- For profit businesses that do business in California and meet one of the law's thresholds.
- The rules
- The California Consumer Privacy Act, as amended by the CPRA, and its regulations.
- Consent model
- Opt out of the sale or sharing of personal information. Browser opt out signals count.
- Enforced by
- The California Privacy Protection Agency and the California Attorney General.
- Penalties
- Fines per violation, higher when a violation is intentional or involves consumers the business knows are under 16.
- Velo default
- Opt out across the United States, with Global Privacy Control honoured.
What California asks.
What Velo does.
Global Privacy Control honoured
California requires businesses to treat an opt out preference signal as a valid request. When a browser sends GPC, Velo turns ad storage, ad user data and ad personalisation off.
Every choice recorded
Each decision is stored with a receipt id, and the GPC state at that moment is recorded too, so you can show what the visitor asked for.
A link that opens preferences
Point your own opt out link at Velo's preferences with window.Velo.openPreferences(), and the floating button keeps the choice one click away.
What the law
actually says.
California does not ask sites to get permission before cookies load. It gives residents the right to tell a business to stop selling or sharing their personal information, and sharing covers making data available to third parties, such as ad platforms, for cross context behavioural advertising. Most ad and retargeting pixels fall into that.
The regulations add two practical duties. You need a clear opt out link, and you must treat a Global Privacy Control signal from the browser as a valid opt out. Ignoring that signal was part of the Attorney General's 2022 settlement with Sephora.
Up and running
in four steps.
From the first script tag to the first recorded choice.
-
Add Velo to your site
Install it with the Google Tag Manager template or paste one script tag. Guides cover WordPress, Shopify, Webflow and other platforms.
-
Scan and sort your cookies
Velo scans your pages, lists the cookies and scripts it finds and suggests a category for each one. You confirm or change them.
-
Design the banner
Pick colours, wording and languages. Reject sits next to accept on the first layer.
-
Publish and check
Visitors in the United States get opt out defaults, and Global Privacy Control switches advertising off. Each choice lands in your consent log with its receipt id.
Before you
go live.
Velo handles the banner, the regional defaults and the records. These parts stay with you.
- Your privacy or cookie notice names each purpose and each third party that sets cookies.
- Tags in Google Tag Manager wait for the matching consent signal before they fire.
- You tested from the region itself: nothing optional loads before a visitor chooses.
- Someone on the team reviews new scripts when a scan finds them.
- If you sell or share personal information, your footer has a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link.
- Your privacy policy lists the categories of personal information you sell or share, and with whom.
In every plan, from €0
Consent Mode v2 advancedRegional defaults by countryGlobal Privacy Control honouredReceipt for every choiceReject as easy as acceptFloating preferences button
Nine banner languagesCookie and tracker scanChoices by categoryConsent log and dashboardWorks with Google Tag ManagerInstallation help
Questions,
answered.
What teams ask about the CCPA and CPRA.
Does the CCPA require a cookie banner?
Not in the EU sense. It requires a way to opt out of the sale or sharing of personal information, which includes sharing for cross context behavioural advertising, usually through a link such as "Do Not Sell or Share My Personal Information".
What is Global Privacy Control?
GPC is a browser signal that tells sites the visitor opts out of sale or sharing. The CCPA regulations require businesses to honour it. Velo reads it on every page and switches the advertising signals off.
Who does the CCPA apply to?
Businesses run for profit that operate in California and meet a threshold, such as annual revenue above the adjusted amount or buying, selling or sharing the data of 100,000 or more consumers or households.
Does Velo apply California rules only to Californians?
Velo applies opt out defaults across the United States rather than state by state, and honours GPC for visitors there who send it.
Is this legal advice?
No. This page is general information. Your notices, contracts and data flows also matter for compliance.
Website privacy, in one place.
Scan your site →
Regulations
GDPR
UK GDPR
CCPA / CPRA
US state laws
LGPD
Ley 1581 (Colombia)
Ley 25.326 (Argentina)
Ley 29733 (Peru)
