CCPA/CPRA and Website Analytics — What Site Owners Need to Know

Short answer: if the law applies to your business, you must tell Californians what you collect and why at the point of collection, honour their rights to know, delete, and correct, and let them opt out of the sale or sharing of their personal information. For analytics, the key question is whether your vendor is a service provider acting only for you, or a third party that uses the data for its own purposes.

Table of Contents

1. Who It Applies To
2. How It Differs From the GDPR
3. Service Provider or Third Party
4. What You Must Do
5. Session Recording Specifically
6. Other US States
7. Key Takeaways

Who It Applies To

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet certain thresholds related to annual revenue, the volume of consumers' personal information handled, or the share of revenue from selling or sharing it. The thresholds are set in the law and adjusted over time, so check the current figures.

A business outside California can be covered if it serves Californians and meets a threshold.

"Personal information" is defined broadly. It includes identifiers such as IP addresses and device IDs, browsing activity, and inferences drawn about a person. Analytics data usually qualifies.

How It Differs From the GDPR

Compliance with one does not guarantee compliance with the other.

Service Provider or Third Party

This distinction decides most of your analytics obligations.

Service provider. A vendor that processes personal information on your behalf, under a contract that prohibits it from using the data for anything other than providing the service to you. Disclosing data to a service provider is not a sale or sharing.

Third party. A recipient that may use the data for its own purposes, such as building advertising profiles across sites. Making data available to such a party for cross-context behavioural advertising is "sharing" and triggers the opt-out right, even if no money changes hands.

For each tool on your site, ask:

• Does our contract restrict the vendor to processing for us?
• Does the vendor combine our visitors' data with data from other sites?
• Is the data used for advertising?

Advertising pixels usually fall on the third-party side. An analytics or session recording tool used only for your own product improvement, under a suitable contract, usually sits on the service provider side.

What You Must Do

1. Notice at collection. At or before the point of collection, tell consumers the categories of personal information collected, the purposes, whether it is sold or shared, and how long it is kept.
2. Privacy policy. Describe your practices and the rights available, and keep it updated.
3. Opt-out link. If you sell or share personal information, provide a clear "Do Not Sell or Share My Personal Information" link.
4. Honour opt-out preference signals. Recognise browser signals such as Global Privacy Control as a valid opt-out request.
5. Respond to rights requests. Know, delete, and correct, within the required time.
6. Limit sensitive personal information use on request.
7. Contracts. Put the required terms in place with service providers and contractors.
8. Data minimisation and retention. Collect and keep what is reasonably necessary for the disclosed purpose.
9. No retaliation against people who exercise their rights.

Session Recording Specifically

• Disclose it in your notice at collection and privacy policy, by name.
• Mask sensitive personal information. Financial account details, precise location, health information, and government identifiers should never appear in a recording (PII masking).
• Use a vendor that acts as a service provider, with a contract to match.
• Be able to find and delete a person's sessions on request.
• Consider consent anyway. Separate from this law, session recording in the United States has attracted lawsuits under state wiretapping statutes. Obtaining consent before recording reduces that risk considerably (session replay lawsuits).

DeepSync defaults to consent-required mode, masks inputs in the browser, and provides export and erasure from the Privacy page, with applicability resolved per session by visitor geography (privacy tools).

Other US States

California was first. A growing number of states now have comprehensive privacy laws with broadly similar ideas: notice, rights of access and deletion, opt-out of targeted advertising and sale, and extra protection for sensitive data. Details differ, including thresholds and whether opt-out signals must be honoured.

A practical approach is to adopt the strictest common standard across the United States rather than maintaining a different experience per state.

Key Takeaways

• The law is notice and opt-out based, unlike the GDPR's opt-in model.
• Whether a vendor is a service provider or third party decides your duties.
• Disclose session recording and mask sensitive information.
• Consider consent for recording because of separate litigation risk.

Conclusion

For analytics, California's law is mainly about being open and controlling where data goes. Know what each script does, contract accordingly, and honour the choices people make.

Read DeepSync's privacy documentation.