CCPA and CIAM: California Privacy Compliance for Consumer Apps

Key takeaways

• CCPA / CPRA applies to businesses serving California consumers above specific thresholds, many B2C apps qualify.
• Unlike GDPR, CCPA's default is opt-out (do-not-sell) rather than opt-in; the legal posture is different.
• Consumer rights, access, delete, correct, opt-out of sale, limit sensitive data, translate to concrete CIAM features.
• CCPA layers with US state-by-state laws (Colorado, Connecticut, Virginia, Texas), implement a unified privacy posture rather than per-state.
• Most CIAM vendors that serve B2C in 2026 ship the building blocks; the harder problem is operational, keeping the records and surfacing the rights cleanly.

What CCPA actually demands

CCPA's enforcement landscape matured through 2023–2026 with the California Privacy Protection Agency (CPPA) issuing regulations, conducting enforcement, and publishing guidance. Combined with parallel state laws (Colorado CPA, Connecticut CTDPA, Virginia CDPA, Utah UCPA, Texas TDPSA, Oregon OCPA, Florida FDBR) the US privacy posture in 2026 is no longer "GDPR doesn't apply to us", there is a meaningful US compliance surface even for purely-domestic businesses.

Consumer rights as CIAM features

CCPA grants seven consumer rights. Five land directly on CIAM:

Right to know (access)

Consumers can request the categories and specific pieces of personal information the business has collected, used, disclosed, or sold. The CIAM exports this on demand. Self-service download from the user account satisfies; manual processes that take weeks do not.

Right to delete

Consumers can request deletion of personal information. The CIAM hard-deletes or anonymizes the record. Some retention exceptions apply (legal compliance, completion of transactions, fraud detection); document the exceptions and apply them consistently.

Right to correct

Consumers can request correction of inaccurate personal information. The CIAM ships self-service profile editing or accepts API calls.

Right to opt out of sale or sharing

The "Do Not Sell or Share" requirement. A clear opt-out mechanism (link, button, GPC signal) the consumer triggers; the business honors by disabling sale / cross-context behavioral advertising sharing. Most CMPs (OneTrust, TrustArc) integrate with the CIAM consent layer to track the opt-out state.

Right to limit use of sensitive personal information

CPRA-introduced. Sensitive PI (precise geolocation, racial/ethnic origin, religious beliefs, health, genetic data, sexual orientation, biometric identifiers, social security number) requires explicit consent and a "Limit the Use of My Sensitive Personal Information" mechanism.

The Global Privacy Control signal

Browsers (Brave, Firefox, DuckDuckGo) ship Global Privacy Control (GPC), an HTTP header that signals "do not sell or share my data." California regulations recognize GPC as a legally binding opt-out signal.

For B2C CIAM, this means: on every request, check the Sec-GPC header; if set to "1", treat the user as opted-out of sale / sharing regardless of whether they explicitly clicked the do-not-sell link. Most B2C-mature CIAM and CMPs ship GPC support in 2026; verify yours does.

Records of compliance

CCPA enforcement increasingly tests the audit trail. The records the business should keep:

• Each consumer request received, with timestamp, type (access / delete / correct / opt-out), and the verification method used.
• Each response provided, with timestamp, content, and turnaround time.
• Consent and opt-out state per consumer, with timestamps for each state change.
• Service provider contracts documenting CCPA-compliant terms with each downstream processor.

The CCPA equivalent of GDPR's "demonstrate consent" requirement is broader, demonstrate the entire compliance posture, not just consent.

Multi-state strategy

By 2026, fifteen-plus US states have CCPA-derivative privacy laws. Building separate programs per-state is unmaintainable. The strategy that works:

1. Identify the strictest requirement across applicable states. California's CPRA tends to be strictest on consumer rights and opt-out mechanism; Colorado is strictest on consent for sensitive data; Connecticut requires opt-out via Universal Opt-Out Mechanism (which subsumes GPC).
2. Implement to that strictest requirement uniformly across all US users. Don't try to detect state and apply different rules.
3. Document the posture. When a state-specific question arrives, the answer is "we apply [strictest requirement] uniformly because it satisfies your state's requirement plus."

Vendor support snapshot

CIAM vendors that ship CCPA-grade compliance tooling (consent records, opt-out flows, GPC support, audit trail):

• SAP Customer Data Cloud, twenty years of B2C CIAM heritage, mature consent and preference center.
• Akamai Identity Cloud, Janrain-derived consent depth.
• MojoAuth, consent management included at competitive price points for mid-market B2C.
• Rownd, embedded preference center as a core product feature, suits B2C consent-heavy apps.
• Transmit Security, Mosaic platform includes consent management at the enterprise tier.

For most consumer-facing CIAM that don't ship deep consent natively, integrate with a CMP (OneTrust, TrustArc, Cookiebot) and let the CMP own the consent state while the CIAM owns the auth. The two systems exchange via webhooks or API.