The most common problems in the California Attorney General's published examples are broken or missing opt-outs for sale or sharing, ignored Global Privacy Control signals, weak notices at collection and clumsy request handling. They are not audit findings from a certifier. They are enforcement examples, and they make a practical test list.
What are these examples, exactly?
The Attorney General's CCPA enforcement page describes cases by industry, without naming the companies, and groups them by the kind of violation. Two update dates appear: 19 July 2021 and 24 August 2022. The page also notes that since 1 January 2023 the law no longer requires a notice of violation or a chance to cure before enforcement. So these are older cases, and the point is the pattern.
Which problems recur?
Opt-out of sale or sharing. This is the biggest group. Examples include retailers with no opt-out mechanism, an opt-out that required a third-party tool, a "Do Not Sell" link that led only to cookie settings, and a portal that did not work.
Global Privacy Control. Several cases involve GPC signals not being processed. The AG's page says businesses must honor GPC as an opt-out of sale or sharing.
Confusing choices. A toggle that opted people in when switched on, and an opt-out link that worked only in some browsers.
Notice at collection. A link that dropped people at the top of a long policy rather than the relevant section, a missing notice for data collected in person, and a missing notice for a service aimed at minors.
Request handling. Excess identity verification, one request method only, account creation required, agent requests refused, and requests to know treated as deletions.
Contracts. Service provider contracts that lacked use restrictions.
What does the law require, in brief?
Per the AG's overview, businesses must give at least two request methods, answer requests to know, delete or correct within 45 days, respond to opt-outs within 15 business days, and post a clear "Do Not Sell or Share My Personal Information" link if they sell or share. Coverage depends on thresholds, including revenue above 25 million dollars or handling the data of 100,000 or more California residents or households. Ask your counsel whether you are in scope.
What to do
- Test your own opt-out end to end from a clean browser, on desktop and mobile.
- Send a GPC signal and confirm that your site treats it as an opt-out.
- Read your notice at collection at each collection point, including forms, apps and in-person flows.
- Offer at least two request methods and remove any need for an account.
- Review service provider contracts for use restrictions.
- Write down your response clocks (45 days, 15 business days) and who watches them.
- List the third-party trackers on your pages and check what each one receives.
Where does software supply chain work touch this?
Third-party scripts and SDKs are often how data is shared. An inventory of components in your site and app, from an SBOM or a scan, helps you see which ones are present. It does not tell you what data they send, and Safeguard does not certify privacy compliance.
Quick check
Do these examples name the companies?
No. The page describes each case by industry only.
Is a cure period still available?
The AG's page says that since 1 January 2023 the CCPA no longer requires a notice of violation or an opportunity to cure before enforcement.
Sources
- California Attorney General, CCPA overview
- California Attorney General, CCPA enforcement case examples
Last reviewed: 18 October 2026.
