See It in One Demo
Identity & Data

The Identity Resolution Compliance Stack: CCPA, CPRA, and the 2026 Rules

Pixels are 'sharing' under CCPA even without money changing hands. The new CPPA regulations took effect January 1, 2026. Here's what your identity resolution program actually needs.

8 min read

The fastest way to lose an identity resolution program isn’t a vendor failure or a match-rate disappointment. It’s a regulator finding out the privacy policy didn’t disclose what the pixel does, and a class-action firm filing a CIPA wiretap complaint two weeks later.

The compliance landscape for identity resolution shifted hard in 2025 and 2026. Brands deploying the technology now need a real compliance stack — not just a privacy policy update. Here’s what’s required.

What CCPA and CPRA actually treat as “sharing”

The rule that matters most: under CCPA and CPRA, retargeting pixels, lookalike audience feeds, and real-time bidding signals are all in scope for the term “sharing” — even if no money changes hands. Source: Cookie-Script CCPA enforcement analysis.

This caught most marketers off-guard. The intuition was: “we’re not selling data; we’re just running tracking.” The CCPA framework doesn’t care. If anonymous visitor data leaves your site for any third-party processing — Meta Pixel, Google Analytics, an identity resolution vendor — that constitutes “sharing” subject to consumer rights.

What that triggers:

  • Right to opt out. Every California resident can opt out of the sharing. The opt-out has to be honored across sessions, devices, and authenticated/anonymous states.
  • Right to delete. Resolved identity records have to be deletable on consumer request, downstream and upstream.
  • Right to know. Consumers can request what data has been resolved or shared about them, and the brand has 45 days to respond.
  • Privacy policy disclosure. The practice has to be named and described in the website’s privacy policy, with vendor categories disclosed.

The penalties: California’s CCPA enables fines up to $7,500 per intentional violation and $2,500 per unintentional violation. Class actions for data breaches separately allow $100–$750 per consumer per incident. Source: California Office of the Attorney General.

The May 2025 Capital One fine

A real example from the enforcement record: on May 1, 2025, the California Privacy Protection Agency took enforcement action against Capital One for embedded tracking technology violations involving Meta Pixel and Google Analytics. Source: Privaini regulatory enforcement summary.

The structure of the case is what matters. Capital One wasn’t running a sketchy data broker scheme. They were running mainstream tracking pixels — the same pixels most Fortune 500 sites run. The CPPA found they hadn’t disclosed adequately, hadn’t honored opt-out signals, and hadn’t documented their processor relationships. The pixels themselves weren’t the violation; the compliance gap around them was.

Identity resolution programs are higher-risk than standard tracking pixels because they go further: they resolve anonymous traffic to identifiable individuals. The disclosure obligations scale with that.

The January 1, 2026 rules

The California Privacy Protection Agency’s new regulations took effect January 1, 2026. Source: Lightbeam CPRA amendments analysis. Three of them apply directly to identity resolution:

1. Annual cybersecurity audits. Businesses processing sensitive personal information at scale (which includes most identity resolution use cases) need to commission and document an annual cybersecurity audit. The audit covers technical safeguards, breach response, and vendor due diligence. Source: Privado CCPA Compliance Playbook.

2. Risk assessments before high-risk processing. Before launching a new identity resolution program, automated decision-making system, or anything that profiles consumers, the brand has to document a formal risk assessment. The assessment names the risks, the mitigations, and the legal basis for processing.

3. Automated Decision-Making Technology (ADMT) rules. If the resolved identity feeds an automated system that makes decisions about the consumer (eligibility, pricing, offers shown), the brand has to provide a pre-use notice and an opt-out path before the decision is made. Many identity-resolution-driven personalization systems trip this requirement.

The compliance posture brands need is not “we updated the privacy policy.” It’s a documented program: privacy policy disclosure, opt-out infrastructure, processor agreements with vendors, risk assessment for the use case, and a cybersecurity audit on file.

The cross-session opt-out gap

A specific compliance trap that’s catching brands: a consumer browses anonymously, opts out via a cookie banner, and the system honors it. Same consumer creates an account or signs in later — and the identity graph links the anonymous session to the authenticated profile. The opt-out state often does not transfer.

Result: a consumer who opted out is now re-enrolled in targeted advertising under their authenticated identity. Source: Privaini compliance gap analysis.

This is a known compliance failure mode. CCPA enforcement explicitly considers the cross-session opt-out as a continuing obligation. If your identity resolution vendor can’t propagate opt-out state from anonymous to authenticated and back, you have a violation in waiting.

The right vendor question: if a visitor opts out via GPC signal on visit one, then logs into their account on visit two, does the opt-out persist?

Global Privacy Control (GPC) is mandatory

Under CCPA and CPRA, businesses are required to recognize and honor Global Privacy Control signals as a valid opt-out request. Source: Munck Wilson Mandala on CIPA pixel litigation. GPC is a browser-level signal. Brave, Firefox, and DuckDuckGo send it by default; Chrome supports it via extension.

Two consequences for identity resolution:

  • The pixel must read the GPC signal and not collect on visitors sending it. No collection means no identity resolution, period. Whatever match rate the vendor quoted, it’s lower because GPC senders are subtracted out.
  • The brand must document GPC handling in the privacy policy and demonstrate it in code. This is one of the items most likely to surface in a CIPA lawsuit discovery.

CIPA wiretap exposure

Beyond CCPA, California’s Invasion of Privacy Act (CIPA) allows private right of action against any tracking that constitutes a “wiretap” — interception of communications without consent. Pixel-based tracking is increasingly being treated as wiretapping under CIPA, and class-action firms are filing complaints at scale. Source: Cookie-Script CIPA exposure analysis.

Identity resolution pixels that capture behavioral signals on the visit (pages viewed, time on site, clicks) are squarely in the CIPA crosshairs. The successful defenses to CIPA cases involve:

  • Pre-collection consent banner where required by jurisdiction
  • Vendor relationships structured as data processor (not third-party recipient)
  • Clear privacy policy disclosure with vendor categories named
  • Documented opt-out infrastructure that propagates cross-session

A vendor that can’t sign a clear data processor agreement (DPA) is a vendor that cannot meaningfully reduce CIPA exposure. This is a hard line, not a soft preference.

What a compliant identity resolution stack looks like in 2026

Six elements:

  1. A vendor that operates as a data processor under signed DPA. Not a “third-party recipient.” The legal posture matters.
  2. Pre-collection compliance gate. Pixel reads GPC signals. Pixel optionally requires a consent banner depending on jurisdiction. Brand can configure both modes.
  3. Privacy policy disclosure. Names the practice, names the vendor, names the consumer rights (opt-out, delete, know), provides a contact path for requests.
  4. Cross-session opt-out propagation. Anonymous opt-out persists when the same identity authenticates. Vendor demonstrates this in writing.
  5. Documented risk assessment. Brand has a written record of the risks identified, the mitigations, and the legal basis for the program. Updated annually.
  6. Annual cybersecurity audit. Brand commissions and retains an audit covering technical safeguards, breach response, and vendor due diligence. Required for businesses processing sensitive PI at scale per the January 2026 rules.

Vendors that can support all six are the ones whose compliance posture survives an enforcement action. The ones that hedge on cross-session opt-out, refuse the DPA structure, or can’t demonstrate GPC handling are the ones that produce a regulatory exposure that lives on the brand’s books, not the vendor’s.

When the GC asks whether identity resolution is safe, the answer is: it’s safe with the right vendor and the right compliance stack. It’s not safe with a vendor that operates as a data broker or can’t sign a DPA. The technology category is legitimate; the legitimacy depends on the implementation.

Most enterprise legal teams approve identity resolution programs in two to three weeks once the compliance documentation is in front of them. The programs that get rejected are usually the ones where the vendor showed up with a sales deck and no DPA — which the legal team correctly reads as a regulatory exposure.

DirectMail.io’s identity resolution program operates under a signed data processor agreement, supports GPC signal handling, propagates opt-out across authenticated and anonymous states, and provides the privacy policy language brands need. The compliance stack is built in, not bolted on.

Sources: