Ccpa Compliance Audit Checklist for Ecommerce Businesses

The CCPA generally covers for-profit businesses doing business in California with preceding-year gross revenue of at least $26.625 million, annual buying, selling, or sharing data of 100,000 or more consumers or households, or at least half of revenue from selling or sharing personal information.

Out-of-state retailers may qualify. Map carts, orders, accounts, loyalty programs, payment tools, and ad identifiers, including recipients. Check whether abandoned-cart marketing uses data beyond checkout purposes.

A store may collect shipping addresses for delivery while retaining browsing identifiers for targeted advertising. These activities serve different purposes and require separate examination of disclosures, retention periods, and data-sharing practices.

Civil Code §1798.100 requires notice at collection of data categories, purposes, and retention.

Compare policy and checkout notices with actual network transfers. Order-fulfillment notices may omit advertising.

The audit should also identify collection that begins before checkout. Product-page trackers may transmit identifiers before customers encounter the store's privacy disclosures. Examine whether required notices are available at or before collection.

Review ecommerce sales compliance separately from unrelated marketing uses.

Sharing can involve cross-context advertising without payment; a sale may involve other valuable consideration. Contract terms and actual use determine vendor status.

Inspect network requests before and after opt-out.

A useful test compares transmitted identifiers, recipient domains, and advertising requests across separate browsing sessions. If restricted transfers continue, determine whether the recipient receives personal information and whether a statutory exception applies.

Distinguish CCPA issues from pixel tracking claims under other laws. Retain timestamped network logs and tracker configurations for retesting.

Civil Code §1798.135 and the regulations require covered businesses to honor qualifying opt-out preference signals, including Global Privacy Control (GPC).

Test guest and signed-in sessions to see whether GPC stops qualifying transfers and reaches linked profiles. Opt-outs generally must be honored within 15 business days without identity verification.

Changes to advertising tags or consent-management platforms may affect earlier configurations. Repeat testing after material website updates and record whether the opt-out continues to function across supported devices and browsers.

Requests to know, correct, or delete generally require acknowledgment in 10 business days and a response within 45 calendar days, extendable by 45 days with notice.

Test deletion across systems. Legal, transaction, or security exceptions may justify retaining specific order records, not entire profiles. Verify required downstream deletion instructions to service providers and contractors.

A deletion test should distinguish active customer records from archived information and legally retained transaction records. Where an exception applies, document the statutory basis and limit further use of retained data as required.

Under Civil Code §1798.140 and regulations §§7051–7053, vendor categories carry distinct contractual duties, including purpose and use restrictions.

Compare contracts with actual flows. Delivery processing differs from advertising platforms' independent targeting.

A contract that describes a vendor as a service provider does not resolve its legal classification if actual processing exceeds permitted purposes. Review access permissions, onward disclosures, and contractual restrictions on independent data use.

Check third-party contract terms before relying on a vendor's claimed classification.

Record each system, legal provision, observed failure, and retest. An undeleted record warrants review of its specific retention exception.

Distinguish confirmed technical failures from potential legal violations. A continuing data transfer may require investigation into vendor restrictions, applicable opt-out obligations, and whether personal information was actually disclosed.

Prioritize findings according to the affected information, ongoing processing, consumer rights involved, and available evidence. Keep remediation records showing what changed and whether subsequent testing confirmed the correction.

Regulators may enforce CCPA violations. Civil Code §1798.150 permits narrower private claims for qualifying data breaches, not ordinary policy defects.

Since January 1, 2026, specified processing, including selling or sharing data and certain sensitive-data uses, requires risk assessment before starting. Preexisting activities have transition rules. The first submission for 2026–2027 assessments is due April 1, 2028.

Risk assessments examine the benefits, privacy risks, safeguards, and reasonable alternatives associated with covered processing. An ecommerce business should examine advertising data sharing against these requirements rather than treating a completed checklist as sufficient.

Separate mandatory cybersecurity audits apply only to qualifying businesses and have phased first deadlines in 2028–2030. This checklist does not replace either formal requirement.