The CCPA, as amended by the CPRA, gives California consumers the rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. For a CTO, the law becomes four engineering decisions: a data map, a deletion path, an opt-out path and vendor contracts.
Does the CCPA apply to us?
Only "businesses" that meet the statute's thresholds are covered, and those thresholds are tested by revenue, by the volume of consumers whose data you handle, or by how much income comes from selling or sharing personal information. The California Attorney General's page summarises the law and links to the text. Get counsel to confirm your status against the current statute, because the dollar thresholds are adjusted over time.
If you are in scope, the rest of this post is the part counsel cannot do for you.
What do the rights mean for systems?
Read the rights as operations your platform must perform on one person's data:
- Know: find every category of personal information about a person and explain sources and purposes.
- Delete: remove it, and tell downstream recipients to do the same, subject to the exceptions in the law.
- Correct: change inaccurate data in the system of record and in copies.
- Opt out of sale or sharing: stop the flow, including when the browser sends a Global Privacy Control signal.
- Limit sensitive data use: honour a narrower purpose for data such as precise location or government identifiers.
Each one fails in the same place. Data was copied into a warehouse, a search index, a support tool or a vendor, and nobody recorded where.
Decision one: who owns the data map?
You cannot delete what you cannot find. The first decision is to name an owner for a living inventory: stores, fields that hold personal information, purpose, retention and every processor that receives the data. Tie it to code review so a new table with an email column cannot ship without an entry.
A constructed example: a product team adds a session replay script to the marketing site. It records form fields and sends them to a third party. If the data map is a spreadsheet updated twice a year, nobody learns this until a deletion request fails.
Decision two: how does a delete request travel?
Build deletion as an event, not a ticket. One request identifier fans out to the primary database, analytics, caches, search, files and each processor's API. Record each step so you can show what was done. Decide in advance what you keep under a legal exception and why, and document it.
Backups need a stated rule. Many teams let deleted records age out on the normal backup cycle and make sure a restore re-applies pending deletions. That is a design choice to write down, not assume.
Decision three: how does an opt-out signal reach ad and analytics code?
The AG page lists the right to opt out of sale or sharing, including through the Global Privacy Control. Treat that signal as input to a consent service that every tag, SDK and server-side export reads. A banner that stores a cookie but leaves a tag manager firing is the typical gap.
Decision four: what do your vendor contracts say?
Processors that receive personal information need contract terms that limit how they use it and oblige them to help with requests. Keep a register of those vendors with the data they get. Software suppliers count too: an SDK that phones home is a recipient of your users' data.
What to do
- Confirm with counsel whether you are a covered business.
- Name an owner for the data inventory and add an entry check to code review.
- Build one deletion workflow that reaches every store and processor, with a log.
- Route Global Privacy Control and opt-out choices through a single service.
- Review vendor and SDK contracts and the data each one receives.
- Test the full path quarterly with a synthetic person.
If your dependency inventory already exists, it is a good starting point for finding SDKs that handle personal data. Safeguard's SBOM and dependency scanning can list the packages in a repository to seed that review.
Quick check
Is a cookie banner enough for CCPA opt-out?
No. The banner is only the interface. The choice must change what tags, SDKs and server exports actually do, including when a Global Privacy Control signal arrives.
Does deleting a user from the main database satisfy a delete request?
Not by itself. Copies in analytics, search, files and processors need the same request, unless a legal exception applies and is documented.
Sources
Last reviewed: 18 October 2026.
