CCPA, CPRA & CIPA Compliance for Shopify Stores

What are the CCPA, CPRA and CIPA?

California has two kinds of privacy law that affect an online store.

California Consumer Privacy Act (CCPA): In effect since January 1, 2020, the CCPA gives California residents rights over the personal information businesses collect about them:

• Right to know: Learn what personal information is collected, used, sold or shared.
• Right to delete: Ask a business to delete their personal information.
• Right to opt out: Opt out of the sale or sharing of their personal information, including sharing for cross-context behavioral advertising.
• Right to non-discrimination: Exercise these rights without being treated differently.

California Privacy Rights Act (CPRA): The CPRA amended the CCPA from January 1, 2023. It added the right to correct inaccurate information and to limit the use of sensitive personal information, and created the California Privacy Protection Agency to enforce the law. Businesses must also honor opt-out preference signals such as Global Privacy Control (GPC) as a valid opt-out request.

California Invasion of Privacy Act (CIPA): CIPA is a 1967 law in the California Penal Code (Section 630 and following) written to stop wiretapping and eavesdropping. Courts and plaintiffs now apply it to websites. Its wiretapping section requires the consent of all parties to a communication, and claims argue that chat widgets, session replay tools and advertising pixels let third parties “listen in” on a visitor’s interaction with a store. Because CIPA allows statutory damages of $5,000 per violation, it has become one of the most common sources of privacy lawsuits and demand letters against online businesses.

What happens if I don’t comply with the CCPA, CPRA and CIPA?

The consequences differ between the two laws:

• CCPA and CPRA fines: Up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (amounts adjusted from January 1, 2025). The California Privacy Protection Agency and the Attorney General both enforce the law.
• CCPA data breach lawsuits: Consumers can sue after certain data breaches for $107 to $799 per consumer per incident, or actual damages if greater.
• CIPA lawsuits: Individuals can sue for $5,000 per violation, or three times actual damages. Most claims are filed as class actions, so exposure grows with the number of visitors.
• CIPA pen register claims: From January 1, 2027, claims under Section 638.51 about tracking on websites and apps can only be brought by the Attorney General, not by private plaintiffs. Wiretapping claims under Section 631, for example over chat or session replay tools, are not affected.

Complying with the CCPA, CPRA and CIPA

For a Shopify store, most of the work is about controlling the cookies, pixels and scripts that run on your site:

• Offer a clear opt-out. Add a “Do not sell or share my personal information” link and make sure advertising tags stop sharing data once a visitor opts out.
• Honor Global Privacy Control. Treat a GPC signal from the visitor’s browser as an opt-out of sale and sharing.
• Ask for consent before tracking runs. CIPA turns on consent, so the safest approach is opt-in for California visitors: block analytics, advertising pixels, session replay and chat tools that send data to third parties until the visitor agrees.
• Keep proof of consent. Records of when and how each visitor consented are your best evidence if you receive a CIPA demand letter.
• Update your privacy notice. Explain what you collect, why, who receives it, and how consumers can exercise their rights.
• Handle consumer requests. Respond to requests to know, delete and correct within 45 days.

A Consent Management Platform (CMP) like Pandectes GDPR Compliance covers these steps on your storefront. It provides a cookie banner with a “Do not sell or share my personal information” link and Global Privacy Control support, and you can set it to require opt-in consent for California visitors, blocking analytics, pixels and session replay scripts until they agree. It automatically scans and classifies your cookies, generates a cookie declaration, keeps consent logs with timestamps and choices as proof of consent, and helps you handle data subject requests.

CIPA case law changes quickly, so review your setup with legal counsel where appropriate.