Skip to main content
Katla supports CCPA/CPRA through an opt-out consent model. Under GDPR, cookies outside the functional category wait for an opt-in. Under CCPA they are allowed until the visitor opts out of the sale or sharing of their personal information, and from that moment the cookie guard enforces the opt-out.

​
How CCPA mode differs from GDPR

The guard runs in both regimes. Before a choice, CCPA mode lets every category through; once a visitor opts out, the guard deletes the cookies outside the functional category and refuses new ones, so an analytics script cannot write back what the opt-out removed.

​
Choosing the regime

Set the regulation in your site’s settings in the dashboard: Auto (Recommended), GDPR, or US State Laws (CCPA). With Auto, the default, the regime is picked in the visitor’s browser from their timezone:
  1. A timezone starting with America/ gets CCPA.
  2. Every other timezone gets GDPR.
That covers the whole of the Americas, not only the United States. Visitors in Canada, including Quebec, and in Brazil and the rest of Latin America get the opt-out model as well. Quebec’s Law 25 and Brazil’s LGPD expect tracking to stay off until the visitor opts in, so if you serve either, choose GDPR rather than Auto. Detection runs entirely client-side with no geo-IP lookup, so the script stays fully CDN-cacheable, and it makes no difference whether you paste the loader inline or link it. See the widget guide for the tag itself. Global Privacy Control does not change which regime applies. It is recorded as a choice inside whichever regime does, as described below.

​
Global Privacy Control (GPC)

GPC is a browser-level signal that tells websites the user does not want their data sold or shared. Under the CCPA regulations, businesses must treat it as a valid opt-out request. When the browser sends GPC and the visitor has not made a choice on your site yet, Katla records the signal as their choice straight away:
  • CCPA mode: an opt-out of sale and sharing, recorded with consentType: 'optedOut'. The banner confirms it: “Your Global Privacy Control signal has been honored.”
  • GDPR mode: a Reject All. “Do not sell or share” has no meaning there, but “no non-essential cookies” does.
A choice the visitor has already made on your site outranks the signal: GPC is only applied when nothing is on file.

​
Checking GPC programmatically

​
.well-known/gpc.json

To declare that your site honours GPC, deploy a .well-known/gpc.json file on your domain:
This file is deployed on your domain, not by the Katla widget.

​
The banner in CCPA mode

  • Title: “Your Privacy Choices”
  • Description: tells visitors that personal information is collected, and that they can opt out of its sale or sharing
  • “Do Not Sell or Share My Personal Information”: the primary button. Records an opt-out.
  • “Close”: records a refusal, keeping functional cookies only. It is not a silent dismiss: a visitor who has seen the notice and closed it is treated as not wanting their information sold or shared, which is the reading that cannot hurt them.
  • “Cookie Preferences”: opens the preferences, where the marketing category is labelled “Sale/Sharing of Personal Information” and an “Opt Out of All” button is available.
The opt-out wording is California’s. There is no separate label for other state laws, and no “Limit the Use of My Sensitive Personal Information” link: if your site needs one, it has to come from your own pages.

​
What an opt-out does

  1. Stores opted_out in the _katla_consent cookie, which lasts 365 days.
  2. Records consentType: 'optedOut', regulation: 'ccpa' and the categories ['functional'].
  3. Deletes cookies outside the functional category, and the guard refuses new ones.
  4. Keeps scripts marked with data-katla-category held back.
KatlaConsent.withdrawConsent() is an opt-out in CCPA mode, and a Reject All in GDPR mode. Every choice is sent to the consent API with its type, categories, regulation and time. The server stores it with a truncated IP address and the visitor’s country, and keeps the latest decision for each visitor. The types you will see in CCPA mode:
  • optedOut: the visitor opted out, or their browser sent GPC
  • rejected: the visitor pressed Close
  • partial and all: the visitor turned some or all categories on in the preferences
Before a choice, the Consent Mode default is denied for all four signals in both regimes, with wait_for_update: 500. When a visitor opts out, all four are updated to denied: Analytics is denied as well, because an opt-out leaves only functional cookies allowed and the guard refuses analytics cookies. Telling Google otherwise would have Google tags try to write cookies the opt-out forbids. A returning visitor who opted out starts from the same four denials. Set privacyPolicyUrl in your widget settings to display a “Privacy Policy” link in the consent banner and preferences modal:
Sites set to CCPA mode also get CCPA disclosures in the cookie and privacy policies Katla generates. Sites on Auto get the GDPR text.