Under the California Consumer Privacy Act, or CCPA, sending data to Meta or Google through a tracking pixel counts as a “sale” (even without an exchange of money) which means it requires your website to have a valid opt-out mechanism. Sephora ($1.2M) and Tractor Supply ($1.35M) were both fined over their lack of compliance with this mechanism. Compliant retailers need three things in place: a consent banner, recognition of Global Privacy Control (GPC) signals, and most importantly validation that their tags actually honor both the banner and the GPC signals. DataTrue tests the third piece, which most programs skip.
Do you actually know what your marketing pixels are actually telling ad networks about your customers? I’ve sat in more meetings than I can count where smart, well-intentioned marketers and privacy teams at major brands believe that they have this covered. They have a Consent Management Platform (CMP), the banner is on their website, it records their users choices, and shows that it’s working. The problem is that the story doesn’t end there.
Even just yesterday I had a meeting with a client where DataTrue found some new PII squeaking through from a Meta tag, likely because someone on their marketing agency team made a modification. Without DataTrue flagging it, who knows how long they would have been leaking PII to Meta in violation of the CCPA. Instead they moved to fix the problem within 24 hours.
The CCPA has a very specific and broad definition of what constitutes a “sale” of data. It doesn’t have to be malicious, it just isn’t integrated into your consent framework. That simple act of your Meta or Google pixel sending browsing behavior or user identifiers to the ad platforms qualifies, and if your user has opted out, that data transmission has to completely stop.
For Sephora and Tractor Supply, it didn’t stop. And they paid a combined $2.55 million in fines to prove it. These aren’t outliers, they’re just the ones that got a bill. This is no longer some sort of theoretical risk or best practice, it’s the operational reality that needs a real technical solution, and simply having a consent banner isn’t the be all / end all of the solution.
Why Your Banner Isn’t Enough
Your consent banner is a promise. It’s a tool that asks a question, and records the answer, but it by itself is not proof that your systems actually respected the answer. The disconnect happens somewhere after that choice that the user makes with the ongoing behavior of your tags. The case with PlayOn proved it yet another time. Their CMP recorded the user’s rejection accurately, but certain tags kept firing anyway. That’s exactly where the liability sat.
For enterprise retailers getting this right requires the three distinct layers of protection. Too many companies only have the first one.
- A Consent Banner: This is table stakes at this point. You absolutely need a clear way for users to grant or deny consent. Most CMPs do this part very well, and it’s the easiest piece, The problem is that it gives companies an immediate and dangerous sense of security.
- Recognition of Global Privacy Control (GPC): This is the next part, and one that many teams miss. GPC is a browser-level signal that tells websites that the user wants to opt out of data sharing immediately when it loads the page. Under the CCPA, you are legally required to honor it as a valid opt-out request, whether or not the user has touched your consent banner. If a user with GPC enabled visits your site then your tags must respond as if that user had clicked “Reject All” even if they never interacted with your banner at all. Tractor Supply’s fine came from failing to honor GPC.
- Post-Consent Tag Validation: This is the crucial third layer that almost everyone skips. You have to have a way to PROVE that when a user has opted out (whether that came from a GPC signal, or the CMP) that the data transmission to the networks like Meta and Google have actually stopped. A single developer, or marketing agency, modification or update can suddenly and accidentally re-enable a previously blocked pixel. A misconfigured tag in your Tag Management can just flat out ignore the consent signal. Your CMP has no idea that this is happening. Ongoing tag and consent validation is the only way to know what your tags are actually doing.
The Sephora and Tractor Supply Fines: A Technical Breakdown
The details matter, so let’s be specific about what went wrong in the cases that we’ve mentioned above.
Sephora ($1.2M): The California Attorney General determined that Sephora was allowing third-party ad tech companies to collect data on user behavior. This was considered an exchange of data for a business benefit (such as better ad targeting) and was deemed a “sale” under the CCPA. Sephora failed to notify their customers about this “sale” and didn’t provide a clear opt-out mechanism. They also failed to honor GPC signals. The fine wasn’t for having pixels, it was for having pixels that acted in a way that constituted an unmanaged and unconsented sale of personal information.
Tractor Supply ($1.35M): This case was even more focused than Sephora’s. Tractor Supply had a CMP banner, but their website and tags weren’t configured to listen for or to honor any GPC signals. California residents who had GPC enabled in their browsers were still being tracked by third-party analytics and advertising tools. The state made it very clear: honoring a GPC signal is not optional. It’s a legally binding opt-out signal, and ignoring it is a direct and big fine worthy violation.
Understand, that for these, and the growing number of other fines that California has levied, weren’t some kind of exotic technical failure. They were very basic failures to connect the user’s expressed privacy choice to the actual reality of what the company’s tags were doing. It’s a gap that can only be found with active testing. For more on this, you can read about the technical gap in most consent platforms and the details of how a Meta Pixel can transmit PII.
How to Close the Gap
You cannot, effectively, manually check every tag on every page of your website(s) after every code release. Sometimes you aren’t even aware a change was pushed, or that your marketing agency made a change that wasn’t even on your website. It’s simply not possible at the scale of modern retail. The only viable solution is to have automated testing that simulates user journeys under different consent states, including with GPC enabled, and that validates exactly which tags fire and what data they send and to whom.
This testing in a perfect world also needs to happen in a pre-production environment, before a code change even goes live. That’s how you can catch an accidental regression that re-enables a pixel or breaks your consent logic. DataTrue is built to do exactly this. It acts like a user, visits your staging site, and provides a clear, timestamped audit trail of what happened, proving that your tags honored the choices you promised they would. Beyond that, it can scan and watch your your website and tags daily, even hourly, to see if something new starts slipping through, and letting you know immediately so you can move to fix the problem as quickly as possible.
Frequently Asked Questions
Does CCPA apply to my company if we aren’t based in California?
Yes. CCPA applies to any business that collects data from California residents, as well as meets certain revenue and data processing thresholds. Given the nature of eCommerce, if you do business in the United States, you almost certainly have California customers and must comply.
Is turning off our pixels the only way to be compliant?
No, and for most retailers, that simply isn’t a realistic option. Compliance isn’t about stopping your marketing; it’s about making it consensual. The goal is to ensure your pixels and tags only collect and transmit data when you have a user’s valid consent, or when they have not opted out.
Our CMP vendor told us their banner makes us CCPA compliant. Is that true?
A CMP is absolutely a necessary tool, but it is not a complete compliance solution on its own. It manages the front-end collection of consent. It does not, however, typically audit or guarantee that all of your back-end systems are correctly honoring that consent on an ongoing basis. As the PlayOn and Tractor Supply cases show, regulators are focused not on what your banner says, but on what your tags actually do.
What’s the difference between GPC and a cookie banner opt-out?
A cookie banner opt-out is a choice that a user makes on your specific site (think the banners that pop up when you load a new site) while GPC is a universal signal sent by the user’s browser to every site they visit, communicating their preference not to be tracked or have their data sold. Under the CCPA, you are legally required to treat the GPC signal as a valid opt-out request without forcing the user to interact with your banner at all.
Necessary “Ask Your Lawyer” Disclaimer: DataTrue is not providing you legal advice. This content explains the technical mechanisms and factual enforcement history. It does not constitute a legal interpretation or compliance guidance. Readers should consult their own qualified legal counsel for advice specific to their situation.
Your banner is asking your customers questions and they expect you to honor their answers. Are you absolutely certain your technology is?