CCPA-Compliant Analytics: What California Requires

California's CCPA (as amended by CPRA) takes a different road to a familiar destination: where GDPR asks 'do you have a legal basis to process?', California asks 'are you selling or sharing personal information?' — and defines both words far more broadly than their everyday meanings. For analytics, that definitional breadth is the entire game.

How analytics trips the 'share' wire

CPRA's 'sharing' covers disclosing personal information for cross-context behavioral advertising — no money required. Classic analytics setups trip it casually: a tracking tool whose vendor also runs an ad network, identifiers flowing to platforms that combine them across sites, pixels feeding custom audiences. Trip the wire and you owe the full apparatus: 'Do Not Sell or Share My Personal Information' links, opt-out flows, Global Privacy Control (GPC) signal handling — which California enforces, as the Sephora settlement demonstrated.

What CCPA does NOT require

Unlike ePrivacy in Europe, California requires no consent banner for analytics cookies — the model is opt-out of sale/sharing, not opt-in to measurement. First-party analytics that never shares data for advertising sits largely outside the drama: you still owe privacy-policy disclosure and data-rights handling for any personal information collected, but no banner, no opt-out link, no GPC plumbing.

The configuration that stays simple

• First-party, single-purpose analytics: a vendor that processes your data only as your service provider (the CCPA term of art), with no ad-side business to feed.
• No persistent identifiers: cookieless measurement with rotating hashes minimizes what counts as personal information in the first place — the data-minimization play that simplifies every privacy law simultaneously.
• No cross-context flows: analytics data that never leaves your account cannot be 'shared' in the statutory sense.

The convergence is the practical takeaway: the same architecture that satisfies GDPR by design — first-party, identifier-free, advertising-disconnected — makes CCPA mostly a privacy-policy paragraph rather than an engineering project. One architecture, every jurisdiction; that is the cookieless dividend compounding.