Back to all glossary articles

CPRA cookie banner

The comprehensive California Privacy Rights Act (CPRA) provides specific guidance to help businesses observe open and ethical cookie practices and privacy regulations worldwide.
Approved on November 3, 2020, the CPRA modifies and improves the California Consumer Privacy Act’s (CCPA) provisions, bringing it closer to GDPR.

What is a cookie banner?

A cookie banner is a pop-up that appears when you visit a website for the first time, informing you about using cookies, asking for your consent, or both.

The cookie banner is an integral part of consent management. And consent management is the practice of asking for, recording and acting upon a website’s visitors’ preferences for data collection. In most consent management solutions, cookie banners are used to obtain consent from visitors.

The banners may take the form of a notice banner that disappears on its own or may require some interaction, such as clicking a button to agree to certain cookies. Different jurisdictions have different cookie banner requirements.

CPRA privacy notice vs GDPR cookie banner

The California Privacy Rights Act (CPRA) does not explicitly require a cookie banner. The CPRA requires businesses to provide privacy notices. These notices must be provided to users when they arrive on the website. There are various types of notifications, and you can serve any of them as a banner.

The notice aims to inform users about data processing, sales, or financial incentives in exchange for data. However, it is not necessary to obtain consent before collecting data.

GDPR, in contrast, requires businesses to obtain consent to use cookies. The GDPR cookie banner aims to inform users about cookie processing and collect consent.


You may also like:

Check out our free Online Cookie Scanner

  • Privacy by design in practice: How “just enough” data beats “just in case” collection

    While collecting more data “just in case” feels safer, according to Matt Gershoff, it’s also one of the biggest sources of unnecessary compliance risk, analytical noise, and wasted organizational resources in the analytics industry today. His approach of “just enough” data collection is more intentional, more aligned with privacy regulation, and often more analytically effective.

  • 4 ways to make your analytics HIPAA-compliant: Implementation guide

    Healthcare organizations have four main approaches to achieving HIPAA-compliant analytics. Each has different trade-offs in cost, technical complexity, and analytics capabilities. This guide compares all four implementation methods – from using Google Analytics with workarounds to deploying fully HIPAA-compliant analytics platforms – so you can choose the right approach for your organization’s needs and resources.

Other definitions

Recent posts from Piwik PRO blog