The Harsh Reality of California Website Compliance Law: Why All USA Businesses Must Comply

What California Website Compliance Law Actually Means

When people say “California website compliance law,” they are not talking about a single statute. They mean a collection of state laws that reach your website because of what your site does, not where your business sits. The state legislature has been unusually active on digital privacy and consumer protection, and the courts have added their own interpretations. Together, those laws set the practical baseline that many other states now copy.

Think of California website compliance law as four connected topics: privacy, meaning what you collect and what you disclose; consumer choice, meaning the rights visitors have to opt out, delete, or correct their information; accessibility, meaning whether people with disabilities can actually use your site; and communications privacy, meaning whether your tracking tools “record” visitors in a way the state treats as wiretapping. Each topic has a different law and enforcer, so the sections below take them one at a time.

Why a Business Outside California Still Has to Care

California does not require you to have a storefront in the state. The CCPA applies to businesses that “do business in California,” and courts and regulators read that phrase broadly to include selling to or collecting data from California residents through a website. If a customer in San Diego buys from your Shopify store or fills out your contact form, you have collected a Californian’s personal information. That is the trigger, not your mailing address.

Regulators have fined companies headquartered in other states for how their websites handled California visitors, and private plaintiffs routinely sue out-of-state businesses. If your analytics show California traffic, assume California website compliance law is on the table.

The CCPA: The Heart of California Website Compliance Law

The California Consumer Privacy Act, expanded in 2023 by the California Privacy Rights Act, is the most important law in this area and the one you will hear about most. The CCPA gives California residents rights over their personal information, including the right to know what you collect, the right to delete, the right to correct, the right to opt out of the sale or sharing of their data, and the right to limit the use of sensitive information. According to the California Attorney General’s CCPA guidance, the law also requires a compliant privacy policy and a prohibition on discriminating against people who exercise these rights.

The word “sharing” deserves attention because that is where most website problems start. Under the CCPA, sharing means disclosing personal information for cross-context behavioral advertising, whether or not any money changes hands. If you have the Meta Pixel, Google Ads remarketing, or a TikTok tag on your site, you are very likely “sharing” in the legal sense. That means you need a “Do Not Sell or Share My Personal Information” link and a working way to honor requests, including automatic opt-out signals like Global Privacy Control sent by a visitor’s browser.

Does the CCPA Apply to Your Small Business?

Here is where you may catch a break. The CCPA only applies to for-profit businesses that meet at least one of three thresholds: annual gross revenue above a figure that adjusts for inflation and currently sits around $26.6 million, buying, selling, or sharing the personal information of 100,000 or more California consumers or households per year, or earning half or more of annual revenue from selling or sharing personal information. Many small businesses fall below all three and are not directly covered.

Before you relax, consider two things. First, the 100,000 consumer threshold counts website visitors whose data you share with ad platforms, and a modest e-commerce site with pixels installed can hit that number faster than you expect. Second, even when the CCPA does not apply, other pieces of California website compliance law still do, and your vendors and payment processors may contractually require CCPA-style practices anyway.

CalOPPA: The Privacy Policy Rule That Applies to Almost Everyone

Long before the CCPA, California passed the Online Privacy Protection Act, known as CalOPPA. This law has no revenue threshold. If you operate a commercial website that collects personally identifiable information from California residents, even just names and email addresses through a newsletter form, you must conspicuously post a privacy policy. That policy has to describe what you collect, who you share that data with, how visitors can review or change their information, how you respond to “Do Not Track” signals, and the policy’s effective date.

For a small business, CalOPPA is often the most realistic starting point for California website compliance law because a clear, accurate privacy policy in your footer satisfies the core requirement. The key word is accurate. A policy that promises “we never share your data” while a pixel fires on every page is a liability rather than a shield.

Accessibility: The Lawsuits Small Businesses Actually Get

If you ask a small business attorney which part of California website compliance law generates the most demand letters, the answer is almost always accessibility. California’s Unruh Civil Rights Act treats a violation of the federal Americans with Disabilities Act as a state civil rights violation, and Unruh provides statutory damages of at least $4,000 per violation plus attorney’s fees. That combination makes California the most active state in the country for website accessibility litigation, and small retailers, restaurants, medical practices, and service businesses are frequent targets.

The practical standard courts and settlements rely on is the Web Content Accessibility Guidelines, commonly WCAG 2.1 at Level AA. In plain terms, that means your images need descriptive alt text, your site must work with a keyboard alone, your color contrast must be readable, your forms must have proper labels, and your videos need captions. The U.S. Department of Justice’s ADA guidance on web accessibility explains that businesses open to the public should make their websites usable by people with disabilities and points to WCAG as the reference.

What an Accessibility Claim Looks Like in Practice

A typical case begins with a demand letter, not a lawsuit. A plaintiff who uses a screen reader visits your site, cannot complete a purchase or read a menu, and their attorney sends a letter citing Unruh and the ADA and asking for a settlement, often in the $5,000 to $25,000 range. Many owners pay because defending the claim would cost more. The legislature has debated reforms for years, but as of this writing none has passed that meaningfully limits these suits.

Overlay widgets, the little accessibility icons some vendors sell, do not solve the problem, and plaintiffs have sued sites running them. Real compliance means fixing the underlying code and content. On WordPress, Squarespace, or Shopify, most of that work involves choosing an accessible theme, writing alt text, and testing with a free tool like WAVE or a screen reader.

CIPA: How Your Analytics Tools Became a Wiretap Problem

The most surprising branch of California website compliance law is the California Invasion of Privacy Act, a 1967 wiretapping statute now used against modern websites. Plaintiffs’ attorneys argue that session replay tools, chat widgets, and tracking pixels that send visitor data to third parties amount to recording or “eavesdropping” on communications without consent. CIPA allows $5,000 in statutory damages per violation, and because website visits number in the thousands, the claimed exposure grows quickly.

Courts have split on these suits, and outcomes depend on the specific technology and facts. What you can control is your consent flow and your disclosures. A clearly worded cookie banner that obtains consent before non-essential trackers load, paired with an accurate privacy policy, substantially reduces your risk, and turning off tools you do not actually use helps even more.

Real Fines and Cases Under California Website Compliance Law

Enforcement is no longer theoretical, and the cases below show what regulators look for. In May 2026, the California Attorney General announced a $12.75 million settlement with General Motors over the sale of drivers’ location and behavior data to data brokers, the largest CCPA penalty in state history and the first enforcement action built on the law’s data minimization and purpose limitation requirements. The state’s message was that companies cannot collect data for one purpose, hold onto that data, and then quietly use or sell that data for something else. The California Attorney General’s press release lays out the terms, including a five-year ban on selling driving data to consumer reporting agencies.

Website tracking is the more common theme, and here the cases hit closer to home for a small business. In March 2026, the California Privacy Protection Agency fined PlayOn Sports $1.1 million after finding that the company’s GoFan ticketing platform, used by roughly 1,400 California schools, deployed third-party cookies and tracking pixels for targeted advertising without an effective opt-out, and effectively required students to accept tracking before accessing tickets they had already purchased. Notably, PlayOn had identified and fixed the problems in December 2024, months before the agency contacted the company, and still paid the full penalty. Self-correction helped the company’s practices but did not erase the fine.

Retail and Media Examples You Can Learn From

Earlier cases established the pattern. Sephora paid $1.2 million in 2022 in the first public CCPA settlement, after the Attorney General found the retailer failed to disclose that analytics and advertising cookies constituted a “sale” and ignored Global Privacy Control signals. DoorDash paid $375,000 in 2024 for sharing customer data through a marketing co-op without notice. In 2025, clothing retailer Todd Snyder paid $345,178 after a broken cookie banner meant opt-out requests were never processed for 40 days, and the company also required customers to submit government ID to opt out. Later that year, Healthline paid $1.55 million and Tractor Supply paid $1.35 million in cases that again centered on tracking technologies and opt-out failures.

Notice what these cases have in common. Not one involved a hacker or a dramatic breach. Every one involved ordinary website tools and either a missing opt-out, a broken opt-out, or a privacy policy that did not match reality. Those are issues you can find and fix on a Tuesday afternoon, which is why California website compliance law rewards attention far more than budget.

Proposed and Upcoming California Laws to Watch

California rarely stops legislating in this area, so your compliance work has an expiration date. Several developments deserve a spot on your calendar. Under the Opt Me Out Act, signed in 2025, browsers offered in California must include an easy-to-find setting that sends an opt-out preference signal, starting in 2027. That will dramatically increase the number of visitors sending Global Privacy Control signals to your site, which means your opt-out mechanism must actually work rather than just exist.

The California Privacy Protection Agency also finalized regulations in late 2025 covering automated decision-making technology, risk assessments, and cybersecurity audits. Most small businesses will not trigger the audit requirement, but if you use software that makes significant decisions about people, such as automated hiring screens, opt-out and notice obligations begin phasing in during 2027.

On the proposed side, AB 2021, introduced in early 2026, would create a whistleblower program modeled on the SEC’s, paying employees and contractors a share of any fine collected based on their reports. If that bill passes, the person most likely to report your compliance gap could be a former marketing assistant who knows exactly which pixels are on your site. Bills on minors’ data and accessibility litigation reform also circulate every session, so checking for updates twice a year is a reasonable rhythm.

How to Bring Your Site Into Compliance

You do not need to fix everything in one weekend, but you do need a sequence. The following steps reflect what regulators have actually penalized and what plaintiffs actually sue over, so they represent the highest-value work you can do.

1. Inventory every script, pixel, cookie, chat widget, and form on your site, and remove anything you do not actively use.
2. Write or update a privacy policy that accurately describes what remains, including the CalOPPA and CCPA disclosures.
3. Add a “Do Not Sell or Share My Personal Information” link and a consent banner that blocks non-essential trackers until the visitor agrees, then test that Global Privacy Control signals are honored.
4. Run an accessibility audit against WCAG 2.1 AA, fix alt text, contrast, keyboard navigation, and form labels, and repeat the check whenever you redesign.
5. Create a simple process for handling data requests within 45 days and document each one.
6. 
   

Once those steps are done, the ongoing work is maintenance rather than construction. Every time you add a marketing tool, ask what data that tool collects and where that data goes, then update your policy and banner before launching. Every time you redesign a page, retest accessibility. Those habits are what California website compliance law looks like day to day, and they cost far less than a single demand letter.

Plenty of this you can handle yourself. Bring in a privacy attorney or qualified consultant if you receive a demand letter or agency inquiry, cross the CCPA thresholds, collect health or financial data, or sell to minors. A short consultation is far cheaper than guessing wrong.

Key Takeaways

California website compliance law reaches any website that collects data from California residents, regardless of where your business is located. The CCPA governs privacy rights and applies above certain thresholds, while CalOPPA requires a privacy policy from nearly every commercial site. Accessibility claims under the Unruh Act are the most common lawsuits small businesses face, and CIPA wiretap claims target ordinary tracking tools. Regulators have fined companies from $345,000 to $12.75 million, mostly for broken or missing opt-outs, undisclosed tracking, and privacy policies that did not match reality. New laws taking effect in 2027 will push more opt-out signals to your site, so a working consent mechanism is the single most valuable investment you can make.

Frequently Asked Questions

Does California website compliance law apply if my business has no California customers?

If your site is public, you almost certainly have some California visitors, and CalOPPA applies whenever you collect personal information from a California resident. The CCPA has thresholds, but accessibility and CIPA claims do not depend on revenue. Assume some exposure and take the low-cost steps first.

What is the difference between the CCPA and the CPRA?

The CPRA is a 2020 ballot measure that amended and expanded the CCPA rather than replacing that law. The CPRA added the rights to correct and to limit sensitive data use, created the California Privacy Protection Agency, and added data minimization and purpose limitation requirements. When you read about “the CCPA” in 2026, the term includes the CPRA amendments.

Do I need a cookie banner in California?

California does not require a banner in the way European law does, but you must provide a way to opt out of sale and sharing, honor Global Privacy Control, and disclose your tracking in a privacy policy. A consent banner that blocks non-essential trackers by default is the most practical way to satisfy those requirements while also reducing CIPA wiretap risk. Many small businesses use one for exactly that reason.

How much does a website accessibility lawsuit cost a small business?

Settlements commonly fall between $5,000 and $25,000, plus the cost of fixing the site, though larger claims exist. Unruh Act damages start at $4,000 per violation with attorney’s fees on top, which is why plaintiffs favor California.

Can I be fined even if I fix the problem before regulators contact me?

Yes. The 2026 PlayOn Sports case involved a company that corrected the issues months before the agency reached out and still paid $1.1 million. Fixing problems quickly still matters because the fine could have been larger and the injunctive terms lighter, but self-correction is not a guaranteed shield under California website compliance law.

Conclusion

California website compliance law can feel like a moving target because the state adds new obligations almost every year. Yet the core has stayed stable: tell visitors the truth about what you collect, give them a real way to say no, keep only the data you need, and make your site usable by everyone. The companies that paid the largest fines did not fail at anything exotic. They installed common tools without disclosure, let opt-outs break, or held onto data longer than they promised. You can avoid every one of those mistakes with an afternoon of inventory work and a habit of rechecking your site each time you change something.

Take the Next Step

Start today by opening your website in a private browser window and asking three questions: Can I find the privacy policy in two clicks? Is there a working opt-out link? Can I complete checkout or the contact form using only the keyboard? If any answer is no, you have found your first project. For deeper guidance, browse our California compliance resources and subscribe to our updates so you hear about new laws before they take effect.