California e-commerce businesses must comply with a layered set of rules: a posted privacy policy under CalOPPA, the CCPA if the business meets its thresholds, reasonable data security and breach notice, all-in pricing and automatic renewal rules, consumer protection laws against misleading claims, refund policy disclosures, website accessibility expectations, and federal rules on email marketing and intellectual property. Most of these apply to any business selling to Californians online, not just companies based in the state.
Websites often launch before their legal framework is in place. California regulators and plaintiffs’ lawyers are active in this space, so build compliance in from the start. Here are the key areas.
1. Privacy: CalOPPA and the CCPA
Start with the rule that applies to almost everyone. The California Online Privacy Protection Act (CalOPPA) requires any commercial website or app that collects personally identifiable information from California residents to post a conspicuous privacy policy describing what it collects, who it shares data with, and how it responds to browser “Do Not Track” signals.
The California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above an inflation-adjusted dollar amount, buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. Covered businesses must, among other things:
- Give a notice at collection and a detailed privacy policy.
- Honor rights to know, delete, correct and limit use of sensitive personal information.
- Offer a “Do Not Sell or Share My Personal Information” link (or an approved alternative) if they sell or share data, including through many advertising pixels and cross-context behavioral advertising.
- Honor opt-out preference signals such as Global Privacy Control.
- Put required contract terms in place with service providers and other recipients.
Regulations adopted in 2025 added rules on cybersecurity audits, risk assessments and automated decision-making technology, with phased compliance dates. For more detail, see our post on California’s new privacy laws.
Website tracking also creates litigation risk outside the CCPA. Plaintiffs have filed many suits under the California Invasion of Privacy Act targeting chat widgets, session replay tools and pixels. Disclosure and consent practices for these tools deserve attention, and the law in this area continues to evolve.
2. Data Security and Breach Notification
California requires businesses that own or license personal information about California residents to maintain reasonable security procedures. If certain categories of unencrypted personal information are breached, the business must notify affected residents, and must also notify the Attorney General when a single breach affects more than 500 Californians. California has recently tightened breach notice timing, so check current deadlines when an incident occurs.
Under the CCPA, consumers have a private right of action, including statutory damages, when certain personal information is exposed because a business failed to maintain reasonable security. If you accept cards, you must also meet the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is a contractual industry standard rather than a statute, but card brands and processors enforce it.
3. Pricing, Advertising and Product Claims
California’s Unfair Competition Law, False Advertising Law and Consumers Legal Remedies Act prohibit misleading product descriptions, fake “was” prices, unsupported claims and deceptive reviews.
Since July 1, 2024, California law generally prohibits “drip pricing”: the advertised price must include all mandatory fees and charges other than government taxes and certain shipping costs. A “service fee” added at checkout is a common violation.
4. Subscriptions and Automatic Renewal
California’s Automatic Renewal Law requires clear disclosure of renewal terms before purchase, affirmative consent, an acknowledgment explaining how to cancel, and an easy online cancellation method for customers who signed up online. Amendments effective July 1, 2025 added requirements, including cancellation “click to cancel” rules, consent before certain price changes, and annual reminders for some subscriptions. Many states have similar laws, so national businesses usually build to California’s standard.
5. Returns and Refunds
California does not require retailers to accept returns, but Civil Code Section 1723 generally requires a retailer that does not give full refunds or exchanges (or credit) within a minimum period to post its policy conspicuously. If it does not, customers may be entitled to a refund within 30 days of purchase, subject to exceptions. As a practical matter, post your return and refund policy clearly and make it available before checkout.
6. Website Accessibility
Website accessibility claims are brought under the federal Americans with Disabilities Act and California’s Unruh Civil Rights Act, which allows statutory damages. Courts have been divided on how these laws apply to businesses that operate only online, but lawsuits continue and settlements are common. Building to the Web Content Accessibility Guidelines (WCAG) 2.1 or 2.2 at Level AA, testing with assistive technology, and posting an accessibility statement are the most practical ways to reduce risk.
7. Intellectual Property
Your brand, product photos, copy and code are business assets. Federal trademark registration strengthens your rights and unlocks enforcement tools on platforms such as Amazon’s brand registry. Copyright protects original content automatically, but registration is required before suing for infringement of U.S. works and is needed to recover statutory damages and attorney’s fees in many cases. Make sure you have licenses for stock images, fonts and templates. If users can upload content, registering a DMCA agent with the Copyright Office and following notice-and-takedown procedures helps preserve safe harbor protection. Our post on trademark basics covers registration.
8. Email and Text Marketing
The federal CAN-SPAM Act requires accurate header and sender information, non-deceptive subject lines, a physical postal address, a working opt-out, and honoring opt-outs within 10 business days. CAN-SPAM preempts most state email laws, but California can still reach false or deceptive commercial email. Text message marketing is governed by the federal Telephone Consumer Protection Act, which generally requires prior express written consent for marketing texts sent with automated systems and carries significant statutory damages.
9. Terms of Service and Sales Tax
Clear, enforceable terms of service, presented so customers actually agree to them, help with disputes, limitations of liability and arbitration. Separately, remote sellers with California sales above the state’s economic nexus threshold must register and collect California sales and use tax, and marketplace facilitators collect tax on behalf of their third-party sellers. Our contract review post explains what to look for in these terms.
The Takeaway
Compliance for a California e-commerce business is not a one-time project. Start with an accurate privacy policy and a map of the data and tracking tools on your site, then work through pricing, subscription, refund, accessibility, IP and marketing rules. Review your vendors and your site whenever you add new tools, and revisit the framework at least annually as the law changes.
Frequently Asked Questions
Does the CCPA apply to every e-commerce business in California?
No. The CCPA applies to for-profit businesses that meet at least one threshold, based on annual revenue, the number of California consumers or households whose data is bought, sold or shared, or revenue from selling or sharing data. CalOPPA, however, requires a privacy policy from virtually any commercial website collecting personal information from Californians.
Do I have to accept returns in California?
No, but if you do not offer full refunds, exchanges or credit within a minimum period, Civil Code Section 1723 generally requires you to post that policy conspicuously. If you fail to do so, customers may be able to return items for a refund within 30 days of purchase, subject to exceptions.
Can I add a service fee at checkout?
Generally not, if the fee is mandatory. California law effective July 1, 2024 requires the advertised price to include all mandatory fees and charges other than government taxes and certain shipping costs.
Is my website legally required to be accessible?
Accessibility claims are brought under the ADA and California’s Unruh Civil Rights Act, and courts have differed on how those laws apply to online-only businesses. Because lawsuits remain common, building to WCAG Level AA is the most practical way to reduce risk.
How Sutter Law Can Help
We help online businesses prepare privacy policies, terms of service and subscription flows, assess CCPA applicability, and respond to demand letters. Learn more about our privacy compliance services, or contact us for a free consultation.
This article is general information, not legal advice. Reading it does not create an attorney-client relationship.
