California website compliance requirements in 2026

Start with the business and the data

California privacy coverage does not turn on visitor location alone. The ordinary for-profit business route in Civil Code 1798.140(d) has revenue, consumer-volume, and data-sale or sharing alternatives. The adjusted revenue threshold in the privacy reference is $26,625,000. The 100,000-consumer or household alternative concerns buying, selling, or sharing, rather than every visit to a website.

For a covered business, examine the notice and the actual tracking choices together. A privacy policy does not establish that a qualifying Global Privacy Control signal reaches every relevant recipient. The cited California rules require honoring qualifying opt-out preference signals. Sensitive-data limitations also differ from a general requirement to obtain adult opt-in consent for every sensitive-data use.

Keep renewal terms beside the buying decision

California Business and Professions Code 17602 addresses automatic renewal and continuous service offers. The source reviewed for this page describes express affirmative consent, a retainable acknowledgment, cancellation mechanisms, and reminders. Contract dates and offer details affect which requirements apply. A screenshot of the checkout button alone cannot establish that the complete enrollment and cancellation process meets the statute.

For review preparation, record the trial length, recurring price, billing interval, consent step, acknowledgment, and cancellation route. Include the annual reminder workflow and any relevant long-term renewal, trial-ending, or fee-change notice. The reference gives the verified timing windows and links to the Attorney General alert. The disclosure checker highlights missing supplied answers; it does not inspect legal applicability.

Review the price customers first see

Civil Code 1770(a)(29) generally requires listed or advertised prices to include mandatory fees. Government charges, shipping costs, and specified industries require separate treatment. The Attorney General describes a distinct conspicuous-disclosure exception for restaurants and listed food vendors. Do not apply that exception to an unrelated subscription business.

Compare the California-facing advertisement, product page, cart, and final payment screen. Record unavoidable charges and the point at which the customer first sees them. This is a practical review sequence, rather than a conclusion that a particular fee is lawful. The price reference identifies the statutory source and the July 1, 2024 effective date.

Separate private websites from state-agency certification

Government Code 11546.7 requires California state-agency website certification. The statute names WCAG 2.0 or a subsequent version, with at least Level AA success criteria. CDT guidance aligns its resource manual with WCAG 2.1. The homepage certification follows a biennial July 1 schedule.

That state-agency certification duty does not automatically apply to every private California business. Federal ADA coverage presents a separate question. Use the accessibility reference to distinguish Title III guidance, the revised Title II government deadlines, and Section 508. A manual accessibility review records sampled barriers and recommended fixes. It does not provide a legal opinion or certify the website.

Verified California provisions

Source review October 24, 2026.

Scroll horizontally to see all columns. Focus the table region to use the arrow keys.

Prepare a focused website review

Observe resource hosts and readable cookie names. Check supplied subscription disclosures.

Privacy and tracking review. Pricing and subscriptions review. Accessibility review.

Next source review January 24, 2027. The cited references retain their separate coverage limits and changelogs.