Is a cookie banner required under CPRA?

The CPRA does not require every website to display a cookie banner. However, businesses covered by the CCPA as amended by the CPRA must inform consumers about the personal information they collect at or before the point of collection.

A cookie banner, preference panel or another privacy interface may be needed when a website uses cookies or similar technologies to:

sell or share personal information, including for cross-context behavioural advertising;

• collect personal information in a way that requires consumer notice or privacy choices; or

• use sensitive personal information in a way that gives consumers the right to limit its use.

• Businesses that sell or share personal information must provide a clear opt-out method and honour recognised opt-out preference signals, such as Global Privacy Control.

Unlike the GDPR, the CPRA does not generally require prior consent for all non-essential cookies. A banner can help provide the required notices and privacy controls, but displaying one does not by itself establish CPRA compliance.