A California banner is not a European banner translated. The European rule is about storage and asks permission before it happens. The California rule is about selling and sharing personal information and gives the consumer a right to stop it, which is a different verb at a different moment. Running one interface for both without saying which rule it is applying is how sites end up with a box that satisfies neither.
Who the obligation attaches to
The Civil Code defines a business by thresholds: annual gross revenues in excess of $25,000,000, or buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of annual revenue from selling or sharing personal information. A company under all three is not a business for these purposes, which matters because a great many small sites install a California banner they do not need and then maintain it badly. Read the definition against your own figures before you build anything.
Opt-out, not opt-in
Where the rule applies, the consumer gets a way to say stop rather than a gate they must pass. In practice that is a clearly labelled link or control, a mechanism that actually stops the sharing when used, and honouring an opt-out preference signal sent by the browser. The last of those is the part most often missing, because it happens without any visible interaction and therefore never shows up in testing that consists of clicking things.
Sharing is broader than selling
The statute covers sharing for cross-context behavioural advertising, not only exchanges for money. That sweeps in the ordinary advertising pixel arrangement most marketing sites run, which is why sites that concluded they sell nothing still land inside the rule. If an advertising platform receives an identifier from your site and uses it to target the same person elsewhere, assume you are in scope and check rather than assume you are out.
How to run one interface for two rules
Vary by region and say so. Serve the European opt-in where the European rule applies and the California opt-out where it applies, and where you cannot reliably tell, pick the stricter. The failure mode to avoid is a single box that says accept or reject in a way that implies a European gate while the tags fire as though it were a California opt-out, because then the words on screen and the behaviour of the page disagree and the words are the ones a regulator reads.
Questions people ask about ccpa cookie banner
Does every site need a CCPA banner?
No. The obligation attaches to a business meeting the Civil Code thresholds. Many small sites are below all of them.
Is a do not sell link enough?
It is the visible part. The mechanism behind it has to work, and an opt-out preference signal from the browser has to be honoured without anyone clicking anything.
What about other US states?
Several have their own laws with similar shapes and different thresholds. If you are building for California, build it so the region rule is a configuration rather than a hard-coded check.
Do I need consent before analytics in California?
Not on the California basis. The question there is sharing rather than storage, which is why a Californian visitor may see a different box from a European one.
Does a California opt-out have to be honoured retroactively?
It has to stop the sharing going forward and the practical expectation is that you also stop the downstream use where you can. Check what your advertising vendors offer for this, because it varies.
Can I show the same banner everywhere to keep it simple?
You can, if it is the stricter one. Simplicity that lowers the bar in one region is not simplicity, it is a defect with fewer moving parts.