Skip to main content

Do you need a CCPA risk assessment?

Article 10 applies to six kinds of processing. Answer seven quick questions and see which triggers may apply to you, and the dates that follow.

Question 1 of 7

§ 7150(b)(1)

Do you sell personal information, or let ad platforms collect it from your site or app for targeted advertising?

Think ad pixels, retargeting tags, audience uploads, and data sales. Sharing counts even when no money changes hands.

How pixels can count as sharing

A planning aid, not legal advice

Questions, answered.

No. Only businesses whose processing falls into one of the six significant-risk activities in § 7150(b). Many do, because selling or sharing personal information, including sharing for cross-context behavioral advertising, is one of them.

Turn your answers into evidence.

Tell us about your site and the processing you need to assess. We'll show you the consent journeys Papaya would run and how the evidence fits your report.

  • A live run of reject-all, accept-all, and GPC journeys on your site
  • How each piece of evidence maps to the fields in § 7152
  • Which of your vendors receive data in each consent state
Which processing do you need to assess?

We use your details only to reply about your request.