Skip to main content

California Consumer Privacy Act (CCPA & CPRA) Runbook

Enforce statutory "Do Not Sell or Share My Personal Information" mandates, real-time Global Privacy Control (GPC) signal honors, and automated Data Subject Requests (DSR).

Step 01: Global Privacy Control (GPC) Automated Honors​

Under California Civil Code § 1798.135(e), websites must treat user-enabled opt-out preference signals (e.g. Sec-GPC: 1 header and navigator.globalPrivacyControl === true) as a valid request to opt out of the sale or sharing of personal information.

Consent Shield intercepts GPC signals instantly upon page load:

// Verification snippet for GPC signal detection
if (navigator.globalPrivacyControl === true) {
  console.log('[Consent Shield] GPC Signal Detected: Automatically disabling sale/sharing');
  window.ConsentShield.setCategoryConsent('marketing', false);
}

Bind any custom link or button in your website's footer to open the granular opt-out dialog:

<!-- Native Consent Shield Trigger -->
<button 
  onclick="window.ConsentShield.openPreferences()"
  class="text-xs text-slate-400 hover:text-cyan-400 font-mono">
  Do Not Sell or Share My Personal Information
</button>

Step 03: Programmatic DSR Intake Submission​

Submit consumer rights requests (Access, Deletion, Opt-Out) into your Consent Shield cryptographic ledger:

curl -X POST https://app.consentshieldai.com/api/v1/dsr \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "CS-LIVE-PROD",
    "request_type": "do_not_sell",
    "subject_email": "consumer@domain.com",
    "consumer_state": "CA",
    "verification_method": "email_otp"
  }'

Need 50-State Statutory Guidance?

Explore our interactive matrix of US state privacy statutes (Texas TDPSA, Virginia VCDPA, Colorado CPA, and Utah UCPA).

Explore Law Matrix →