CMP Display Management for CCPA Compliance

Conditional Display Based on Geolocation

Sirdata’s CMP automatically detects the user’s location and adjusts the display of the consent banner according to the applicable privacy laws.

For the California Consumer Privacy Act (CCPA), the specific CCPA banner is only shown to users located in U.S. states where such disclosure is legally required, such as California.

✅ This behavior ensures a better user experience by limiting the CCPA banner display to only those users who are actually subject to the law.

---

Option: Force Display Across All U.S. States

Upon request, it is possible to enable an option that displays the CCPA banner to all users in the United States, regardless of which state they are in.

🔧 This option is useful for companies that want to enforce a uniform policy or simplify their compliance strategy.

---

“Do Not Sell My Personal Information” Button

In compliance with the CCPA, a “Do Not Sell My Personal Information” link is displayed at the bottom of the website (footer) once the banner has been closed.

This link allows users to reopen the banner and review or update their consent preferences.

---

Option: Remove the Footer Button

It is also possible to disable the “Do Not Sell” button in the footer. If this option is selected, it is recommended to provide an alternative method for users to reopen the CMP (e.g., via a link in the privacy policy, legal notice, or footer).

⚠️ Important: To remain compliant with the CCPA, users must always be able to revisit and adjust their privacy choices at any time.

---

Global Privacy Control (GPC) Signal

The Global Privacy Control (GPC) is a signal that the visitor's browser sends to every website: it states that the visitor objects to the sale and sharing of their personal information. Some browsers send it on their own, others through an extension.

Several U.S. states require businesses to honor this signal. Sirdata's CMP detects it and applies the opt-out for you.

Turning GPC Support On or Off

In the portal: Advanced settings > Regulations, CCPA section, option Honor the Global Privacy Control (GPC) signal.

• The option is enabled by default.

• It is only available when the CCPA is enabled for your site.

⚠️ Attention: honoring the Global Privacy Control is legally required in twelve U.S. states since January 2026. By deactivating this option, you take responsibility for handling the signal yourself.

Which Visitors Are Concerned

The signal is honored for visitors located in a U.S. state where the CMP applies the CCPA, or in any U.S. state when the Apply to all USA states option is enabled. Elsewhere, the CMP does not apply it.

On the CCPA Banner

When the CMP honors the signal:

• the opt-out of sale and sharing is recorded automatically, without asking the visitor anything;

• on the first page view with the signal, the choices window opens once to confirm it: "Because your browser sent a Global Privacy Control signal, your opt-out has been applied automatically. You don't need to do anything." It does not reopen on its own on later pages;

• as long as the signal is sent, the choices window shows this message instead of the opt-out switch: to withdraw their opt-out, visitors must turn off GPC in their browser;

• the opt-out is passed on in the usprivacy string (3rd character Y) and in section 7 of the GPP (US National), which also reports that the signal is present.

On the GDPR Banner, When the GDPR Applies to All Your Visitors

If you apply the GDPR to all your visitors (Advanced settings > Regulations > Apply the GDPR: To all users), your U.S. visitors see the GDPR banner. The signal is honored there too, for the same visitors:

• the banner is not displayed, and the CMP records a full refusal (all purposes and all partners, legitimate interest included);

• a short notice is shown instead: "Because your browser sent a Global Privacy Control signal, your opt-out has been applied automatically. You don't need to do anything." It offers two links:

  • Set your choices opens the banner, where the visitor can accept if they wish;

  • Close dismisses the notice without changing anything;

• consent given before the signal was sent no longer counts: the refusal replaces it;

• a choice made after the notice, with the signal on, is kept on later pages.

✅ This way, you keep GDPR prior consent for all your visitors while honoring the signal as U.S. laws require.

Partner Modules Follow the Signal

When the signal is honored, the enabled modules pass on the opt-out as soon as the page loads:

Module	CCPA banner	GDPR banner
Google Consent Mode	advertising and measurement signals denied (ad_storage, ad_user_data, ad_personalization, analytics_storage)	advertising and measurement signals denied
Facebook Consent Mode	Limited Data Use: events are sent, Meta limits their use	pixel paused
OpenAI Consent Mode	denied	denied

🔗 Learn more about the signal: globalprivacycontrol.org.