CCPA and GDPR in 2026: What Your Business Website Needs Now

California's privacy law has added rights since it began. Here is what is true now and simple steps a small business can take this week.

California's privacy law gives people more rights than when it began. If your business meets the CCPA size or data limits, and your site collects emails or takes orders, the law can apply to you. This week, check your privacy notice, your opt-out link and how you answer data requests.

What changed since the law started

The California Consumer Privacy Act, or CCPA, is a state law about personal information. Personal information means facts that can be tied to a person, like a name or an email address. The California Attorney General says the law gives people more control over their data. That means the data businesses collect about them.

In November 2020, California voters approved Proposition 24, also called the CPRA. It changed the CCPA. It added new protections that began on January 1, 2023. The CPRA is not a separate law. The Attorney General's office calls it "CCPA" or "CCPA, as amended."

Other privacy laws matter too. BriteCity notes that the European Union's GDPR began in 2018. It says more than 19 US states had passed full privacy laws as of 2026. It also says penalties range from thousands to millions of dollars. And it says enforcement is speeding up.

The rights California consumers have now

The Attorney General lists these rights for California residents:

• Right to know. People can ask what data you collected and where it came from. They can ask why you use it and who you share it with. They can ask up to twice a year, free of charge.
• Right to delete. People can ask you to delete their information, with some exceptions. One example is when the law requires you to keep it.
• Right to opt out. To opt out means to say no. People can tell you to stop selling or sharing their information. They can do this with a setting they turn on. It is called a global privacy control, or GPC.
• Right to correct. Since 2023, people can ask you to fix wrong information.
• Right to limit. Since 2023, people can limit how you use and share their sensitive personal information.
• Right to non-discrimination. You cannot treat people worse for using these rights.

Does the law apply to your business?

A law firm guide says the CCPA covers for-profit businesses that do business in California. These businesses also collect personal information about people who live there. This can apply even if the business is not in California. The business must also meet one of three more tests. That guide was written before the law began in 2020. So check the current rules on the Attorney General's site.

The same guide says some data is covered by other federal laws instead. Examples are HIPAA, GLBA, FCRA and DPPA.

Personal information is a wide term. Elementor lists email addresses, IP numbers, browsing history and shopping preferences. An IP number is the address a device uses online. Elementor also says regulators have stepped up enforcement.

The GDPR works in a different way. BriteCity says it covers any business that offers goods or services to people in the EU. It also covers a business that tracks their behavior. Where the business is based does not matter. BriteCity says a website people can reach in the EU with analytics tracking is enough. BriteCity says the GDPR uses opt-in consent. That means a person must say yes first. The CCPA uses an opt-out model.

Steps you can take this week

1. List what your site collects. Check contact forms, email signups, analytics and online orders.
2. Update your privacy notice. The Attorney General says covered businesses must give notices. These explain how they handle data. Make sure yours mentions the rights to correct and to limit.
3. Add a clear opt-out link. Elementor calls the "Do Not Sell or Share My Personal Information" link a key CCPA rule.
4. Respect GPC signals. The Attorney General says people can opt out through a global privacy control.
5. Plan how you answer requests. Pick one person and one inbox for data requests. For EU residents, BriteCity says you must respond within 30 calendar days.
6. Look at cookie consent tools. A cookie is a small file a website saves in a browser. Elementor names several tools. They include Cookiebot, CookieYes, Complianz and its own Cookie Consent feature.
7. Ask a lawyer about your case. The Attorney General says its FAQs are not legal advice.

How I can help

Here is a little about AppWT. AppWT has built 600+ websites, by its own count. AppWT has a core team of 7. AppWT is practicing since 1997 and operating as AppWT since 2005. AppWT is based in Livonia, Michigan.

Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.

Sources

• California Consumer Privacy Act (CCPA), California Department of Justice, Office of the Attorney General, 2018-10-15
• GDPR & CCPA Compliance: A Data Privacy Guide (2026), BriteCity, 2026-01-07
• California's Data Privacy Law: What It Is and How to Comply (A Step-By-Step Guide) | Dickinson Wright, Davis Wright Tremaine LLP, 2026-10-21
• 10 Best Ccpa Compliance Guide For Small Business Websites in 2026, elementor.com, 2026-07-17