CCPA/CPRA: The Complete Engineering Implementation Guide

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), along with a patchwork of over 20 other US state privacy laws (like Virginia’s VCDPA and Colorado’s CPA), present unique engineering challenges. Unlike GDPR, which focuses on opt-in consent for data processing, the US state framework primarily operates on an opt-out model for the “sale” or “sharing” of personal information.

This guide covers the technical implementation of key US State Privacy controls, including the critical Global Privacy Control (GPC) signal.

1. The “Do Not Sell or Share” Mechanism (us-state-1)

Under CCPA/CPRA, you must provide a clear mechanism for users to opt out of the sale or sharing of their personal information for cross-context behavioral advertising.

From an engineering perspective, this requires maintaining an opt-out registry and propagating that state to all third-party scripts (like Facebook Pixel, Google Ads, or Analytics).

Database Schema for Consent Preferences

CREATE TABLE user_privacy_preferences (
    user_id UUID PRIMARY KEY REFERENCES users(id),
    do_not_sell BOOLEAN DEFAULT false,
    do_not_share BOOLEAN DEFAULT false,
    limit_sensitive_use BOOLEAN DEFAULT false,
    updated_at TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP
);

Express.js API Endpoint for Opt-Out

// US State Privacy - CCPA Opt-Out Mechanism
export async function handleCcpaOptOut(req, res) {
  const { optOut } = req.body;
  const userId = req.user.id;
  
  if (optOut) {
    await db.query(`
      INSERT INTO user_privacy_preferences (user_id, do_not_sell, do_not_share) 
      VALUES ($1, true, true)
      ON CONFLICT (user_id) DO UPDATE 
      SET do_not_sell = true, do_not_share = true, updated_at = NOW()
    `, [userId]);
    
    // Propagate to CDP or Data Warehouse
    await syncOptOutToCdp(userId);
  }
  
  return res.json({ success: true });
}

2. Global Privacy Control (GPC) Signal Recognition (us-state-4)

California’s Attorney General has made it clear that honoring the Global Privacy Control (GPC) browser signal is mandatory. GPC is sent as an HTTP header (Sec-GPC: 1) or via the DOM API (navigator.globalPrivacyControl).

Server-Side GPC Interception Middleware

// US State Privacy - GPC Signal Recognition
export function checkGpcSignal(req, res, next) {
  // Check the HTTP header sent by compliant browsers (Brave, Firefox, etc.)
  const gpc = req.headers['sec-gpc'];
  
  if (gpc === '1') {
    // If user is authenticated, update their preferences
    if (req.user) {
      req.user.preferences.doNotSell = true;
      req.user.preferences.doNotShare = true;
    }
    
    // Set a cookie for the client-side to suppress third-party scripts
    res.cookie('us_privacy_gpc', '1', { 
      maxAge: 31536000000, 
      httpOnly: false, // Needs to be readable by client JS
      secure: true,
      sameSite: 'Lax'
    });
  }
  
  next();
}

Client-Side Tag Management with GPC

On the frontend, before firing any tracking pixels, you must check for the GPC signal:

function canFireTrackingPixels() {
  // 1. Check DOM API
  if (navigator.globalPrivacyControl) {
    return false;
  }
  
  // 2. Check for the cookie set by our middleware
  if (document.cookie.includes('us_privacy_gpc=1')) {
    return false;
  }
  
  // 3. Check explicit user preference from DB (hydrated to window state)
  if (window.__INITIAL_STATE__?.privacy?.doNotSell) {
    return false;
  }
  
  return true;
}

if (canFireTrackingPixels()) {
  loadGoogleAnalytics();
  loadMetaPixel();
}

3. Data Minimization & Purpose Limitation (us-state-2)

States like Maryland (MODPA) and California have strictly codified data minimization. You cannot collect data “just in case.” Collection must be directly relevant and necessary for the disclosed purpose.

Payload Validation Guard

// US State Privacy - Data Minimization Validation
const ALLOWED_FIELDS_BY_PURPOSE = {
  'newsletter_signup': ['email', 'first_name'],
  'checkout': ['email', 'shipping_address', 'billing_address', 'payment_token'],
  'support_ticket': ['email', 'issue_description', 'browser_info']
};

export function validateDataCollection(payload, purpose) {
  const allowedFields = ALLOWED_FIELDS_BY_PURPOSE[purpose];
  
  if (!allowedFields) {
    throw new Error(`Unknown processing purpose: ${purpose}`);
  }
  
  for (const field of Object.keys(payload)) {
    if (!allowedFields.includes(field)) {
      // Log the violation to your security monitoring system
      auditLogger.warn(`Data minimization violation: field ${field} not required for purpose ${purpose}`);
      
      // Strip the field before it hits the database
      delete payload[field];
    }
  }
  
  return payload;
}

4. Consumer Health Data Protection (us-state-3)

Washington’s My Health My Data Act (MHMDA) and Nevada’s SB 370 have created a new category of highly protected consumer health data, enforced via severe private rights of action.

Unlike HIPAA, which only applies to covered entities, MHMDA applies to any app collecting health-related inferences (e.g., diet tracking, fitness apps, symptom checkers).

// US State Privacy - Health Data Protection Guard
export function enforceHealthDataProtection(req, res, next) {
  // Identify endpoints dealing with consumer health data
  const isHealthEndpoint = req.path.startsWith('/api/health-metrics') || 
                           req.path.startsWith('/api/symptoms');
                           
  if (isHealthEndpoint) {
    // MHMDA requires explicit, separate consent (not buried in terms)
    if (!req.user.hasExplicitHealthConsent) {
      return res.status(403).json({ 
        error: 'Explicit affirmative consent required for consumer health data under Washington MHMDA/Nevada SB 370' 
      });
    }
    
    // Health data cannot be sold under MHMDA without a separate, highly specific authorization
    // Geofencing for health facilities is also prohibited
  }
  
  next();
}

5. Data Broker Registration & Deletion Requests (us-state-5)

Determine first whether the organisation meets the applicable data-broker definition; a product with a direct consumer relationship is not automatically a data broker. For in-scope California operations, keep a reviewed register of collection sources, downstream recipients, registration status, and deletion-request processing evidence.

type BrokerDeletionRequest = { requestId: string; receivedAt: string; status: 'received' | 'matched' | 'deleted' | 'exception'; };

export async function recordBrokerDeletionRequest(requestId: string) {
  await appendDeletionLedger({ requestId, receivedAt: new Date().toISOString(), status: 'received' });
}

The California Privacy Protection Agency’s data-broker guidance describes registration and the DELETE Act’s accessible deletion mechanism. This pattern does not determine legal applicability.

6. Children’s Privacy Protection (us-state-6)

Minimise age-assurance data, separate it from product profiles, and enforce a retention deadline. COPPA applies to specified child-directed services and services with actual knowledge; state rules may impose additional requirements.

export function canCollectChildData(input: { ageVerified: boolean; parentalConsent: boolean }) {
  return input.ageVerified && input.parentalConsent;
}

Log the method and version of consent evidence, not unnecessary identity documents. The FTC’s COPPA Rule materials are a primary starting point for US federal children’s privacy requirements.

Conclusion

The US privacy landscape is highly fragmented. Build a jurisdiction-aware processing inventory, test opt-out and deletion paths, and have counsel validate the obligations that apply to your product and data flows.

Use the Matrix to record your own implementation status. The SovereignShield CLI evaluates supplied, self-reported control statuses; it does not inspect a repository or determine legal compliance.