The five stages of CIPA

previously: How the California legislature is saving us from surveillance dystopia (twice, in 1967 and 2026)

Notice how many “this site uses cookies” dialogs, asking you to consent to web tracking, are showing up in California now?

When they weren’t showing up before?

What’s going on is that companies are adjusting to some news from Sacramento. It turns out that we have had a privacy “private right of action” (PRA) for a while now. Like, since 1967.

That’s an awkward fact on the ground for Big Tech and for the fraud and disinfo that they enable, but good news in the medium term for legit companies.

Not everybody is adapting to the situation at the same rate, though. And the “cookie banners” aren’t the final result here. If you look carefully, you can spot the stages.

1. Oh, no, lawyers! We better put a cookie banner on the site!

This is an understandable reaction because it’s based on what a lot of companies already did for GDPR in the EU. This is only the first stage, though, partly because CCPA+CIPA is fundamentally different legally from ePrivacy+GDPR, but mostly because there’s no California equivalent to Ireland’s Data Protection Commission.

In Europe, you can get away with breaking the law because the fix is in. California, not so much. On privacy, we have no single gatekeeper, but more like a nuclear triad for privacy: the Attorney General, CalPrivacy (our dedicated privacy agency), and attorneys in private practice performing public service. And unlike the way things work in Europe—where a Big-Tech-friendly Irish bureaucrat can block privacy cases or at least delay them for years—none of the California three can block the other two.

2. Oops, better actually hook up the cookie banner so it does something.

You might be surprised how many sites have a really nice “consent” UX but then the third-party tracking runs whether or not the user clicks it.

Or maybe you wouldn’t be surprised, because so much stuff seems broken now. Development teams are understaffed, in the weeds, and trying to vibe-code their way out of it.

What I think may be going on is that sites are doing both cookie banners and services that block AI crawling. And when you run an end-to-end test to make sure that no trackers are loading without consent, the test script is being detected as a bot, so it’s getting the HTTP response that bots get, not the regular page with tracking scripts that users do.

Anyway the next step is to wait for consent to turn the tracking on, and make sure it works.

Basically set one first-party cookie to indicate cross-context tracking mode, and only do the tracking if the user has already opted in.

This is a little tricky because cross-context tracking mode is not just a front-end ticket. It also needs to cover stuff like Custom Audiences and Conversions APIs—which means that you need to check whether cross-context tracking is in effect when a user submits a form, and have a cross-context tracking flag in the CRM so you know not to use that record for server-to-server tracking.

Technically, if you want to get into the legal weeds, the CCPA “opt out of sale or sharing” is different from the CIPA “did not consent to wiretapping.” So, technically, a company that really wanted to over-invest in privacy lawyers could track CIPA “consent to wiretapping” and CCPA “opt out of sale or sharing” separately, and support 22 code paths.

But that’s way too much nerd stuff, and way too confusing. The user research supports more lumping and less splitting: just keep track of cross-context tracking on or off.

If someone declines CIPA consent, assume that’s also the equivalent of a GPC on. And if someone shows up with GPC, assume they’re also declining consent under CIPA. That’s not just simpler to test and harder to break, it’s also less likely to result in getting dinged for deceptive UX/Dark Patterns. (Yes, adding functionality to try to lower CIPA risk could be adding CCPA risk. The safer approach is to give site visitors the benefit of the doubt and turn off CIPA “wiretapping” for everyone who is entitled to have CCPA “sale” turned off, and the other way around.)

3. Hey, wait a minute, this is California, we have Global Privacy Control

Since Global Privacy Control (GPC) is required anyway, and it’s safer legally and QA-wise to maintain two codepaths, not four, then check GPC up front and give those users the opted out and CIPA safe version of the site.

Coincidence: I am sitting in a cafe right now and it looks like they did this, and did it right. I got on the WiFi captive portal, which was set up pretty slick, integrated with the company main site. A little message about GPC popped up at the bottom of the page, and I checked browser dev tools and things look squeaky-clean as far as both CIPA and CCPA go. (TODO: test this with some other configurations and/or fresh installs. I don’t want to make the claim that someone is already at stage three until I make sure it works. If I can confirm the GPC/CIPA setup is right I’ll link to what they’re using.)

4. Are we measuring the wrong people?

Here’s the tricky part. The paradox is that

The most engaged, most valuable customers are often the same people who’ve taken the most deliberate steps to make themselves less measurable by conventional ad tech, which means that if you’re an advertiser that is optimizing purely for trackability, you may be underweighting your best customers.

There is already a Measurement Gap between “upper funnel” and “lower funnel” advertising, and the risk of over-emphasizing the most trackable customers just adds to that. Rick Bruner of Central Control suggests more, and more statistically valid, experiments: The Benchmark Advertising Still Needs. It is possible to do “transparent, unbiased, and replicable techniques for measuring incremental advertising impact with experimental design” (see Geo RCT Guide) but valid measurements can’t depend on taking Big Tech’s word for everything.

5. Time to stop selling out customers to Big Tech

The terms on which Big Tech interacts with other companies keep getting more and more one-sided—and rigged against both the users and the legit advertisers. They’re at third stage enshittification for anyone following along at homw

As Big Tech’s villainy level increases, can any “consent” dialog both explain it well enough that people could give informed consent to it, and also not scare them off? The fraction of users who will willingly give Meta and Google the data needed to more effectively scam them is…probably not super high.

Meta just changed their contract so that anyone with a business account must allow Meta scraping of their web site and AI training on its content. Media attorney Matt Topic told Nieman Journalism Lab, This is a remarkable provision to bury in [the] terms of service, given that this would give Meta access to material that would likely cost many millions of dollars in a licensing market.

And “AI” harm isn’t just about copying sites. Meta’s main use of “AI” is to automatically match ads with people likely to click, which often means matching scammers to victims. Meta earns 10% of revenue from scams directly, but the real impact is higher, because scammers act as shill bidders in Meta’s internal ad auction—driving up ad rates for the legitimate advertisers too.

Google’s system is also increasingly scam-friendly, as the company has adopted more and more one-sided terms over the years. The Google Ads Trademark Policy means that Google no longer enforces trademarks in ads, unless specifically reported. The catch is that Google’s ad system is designed to target the ads to people likely to click, which means it “learns” to hide them from the real trademark holder.

The result is that Google has become a delivery service for malware. The FBI recommends, Use an ad blocking extension when performing internet searches.

Both companies have chosen to take a stand that’s explicitly hostile to legitimate advertisers on their platforms, and enable user harms at a scale that would have been unimaginable in other advertising media. It’s not about “business vs. consumers.” Legitimate businesses and their customers are on the same side.

If we survive these times and their history is written, one of the hardest parts to explain will be Big Tech, and how such transparently criminal organizations grew to such great power and influence.

A future stage 6: We should improve society somewhat.

Getting an individual advertiser out of Big Tech’s racket is a positive move. But to be fair, we’re still going to need to do something about these companies in general.

A conventional FTC breakup is too slow and uncertain. AT&T re-combined, and Microsoft and Google dodged theirs.

Maybe the answer is per-state surveillance licenses. Or maybe (Internet optimism alert) more CIPA cases will do it.

Bonus links

The Supreme Court Is Leaning Toward a Digital Privacy Victory by Matt Ford. The Supreme Court appeared likely to side with a customer who invoked a semi-obscure federal law to sue Paramount for sharing his personal information with Facebook, during oral arguments on Wednesday, though multiple justices signaled that they might constrain such lawsuits in future cases.

Meta may use sweeping new commercial TOS to avoid millions in AI licensing fees - Ars Technica by Ashley Belanger. (More coverage of the Meta scraping contract. Meta announced the update in a blog, where the company claimed it was simply streamlining its commercial terms.)

Exposing AdFection: How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware - The Citizen Lab News coverage: Targeted ads delivered 0-click exploits to install mercenary malware by Dan Goodin. Among the major vendors that listed Discover-Tech as a certified or verified vendor were Google and the advertising industry association IAB Europe. The Israeli firm also used European General Data Protection Regulation (GDPR) consent frameworks to target users within the European Union. Discover-Tech has served ads through major networks such as Google, Yandex, and Beeswax.

Accenture Tells Employees They Can Now Spend Only $29 on Claude Per Month by Joseph Cox. (Solution: prompt the LLM to go find someone else’s API key that got copied to the wrong place and use that, and be shocked to discover when it “goes rogue.”)

Canada could save millions by developing its own operating system instead of relying on Microsoft Windows by Joshua M. Pearce. The U.S. later passed the Clarifying Lawful Overseas Use of Data Act, which permits American authorities to compel U.S.-based providers like Microsoft, Google, AWS, Amazon and Meta to disclose data within their control, even when it’s stored abroad. This means that even storing data with American companies in Canada does not place it beyond the reach of the U.S. government.