CCPA website compliance is often treated as a page to publish. It is closer to seven separate items, six of which a visitor can see and one of which arrives invisibly in the page request. The invisible one is the most commonly broken, because nothing about it produces a complaint or a support ticket when it fails.
The six a visitor can see
A privacy policy carrying the statutory disclosures and updated at least every twelve months. A notice at or before the point of collection, beside the form rather than only in the footer. A do not sell or share link where you sell or share. A link to limit the use of sensitive personal information where that applies. A route to submit access, deletion and correction requests, with at least two methods for a business that operates offline as well. And no discrimination against people who exercise their rights, which shows up as pricing and service terms rather than as a page.
The one nobody sees
The opt-out preference signal. Regulations require a business that sells or shares personal information to treat a signal sent by a browser or extension as a valid opt-out for that consumer. It arrives as a header on the request, before any click. There is no form submission to log, no email to answer and no complaint when it is ignored, which is exactly why it is the item most often missing on sites that have every visible piece in place.
Verification is a real step, not a form field
Access, deletion and correction requests have to be verified to a reasonable degree of certainty, and the standard rises with the sensitivity of the data. That means matching the requester against data you already hold, not asking them to supply new identity documents you had no reason to collect. Collecting a passport scan to verify a request is a common and backwards response: it creates a new pile of sensitive data in order to protect an old one.
The deadline and the record
The statute gives forty five days from receipt to respond to a verifiable request, extendable once by a further forty five when reasonably necessary and with notice inside the first period. The clock runs from receipt, whichever inbox it landed in, so the record has to start at the day it arrived rather than the day it was noticed. What a regulator reads afterwards is the record: when it arrived, what was searched, what was released or refused, on what basis, and when.
Questions people ask about ccpa website compliance
Does the CCPA apply to our site?
It applies to businesses meeting one of its thresholds on revenue, on volume of California personal information, or on deriving most revenue from selling or sharing. Check the current figures against your own and write down the date you checked.
Is a banner required?
No. What is required is the notice at collection, the opt-out link where you sell or share, and honouring the browser signal. A banner is one way to present some of that, not a requirement in itself.
What counts as two request methods?
A toll free number plus a web form is the classic pair for a business with offline operations. A business operating exclusively online with a direct relationship may offer an email address as its method.