California Compliance for Affiliate Marketers
The largest market with the strictest rules: California's consumer-protection, CCPA/CPRA privacy, and automatic-renewal laws — and why meeting them clears most other states.
California is the single most important US state for affiliate compliance, for two reasons: it is the largest consumer market, and it has the country’s most developed consumer-protection, privacy, and subscription laws. Meeting California’s standards is a practical way to clear the bar in most other states at the same time.
Consumer protection
California’s Unfair Competition Law and False Advertising Law prohibit unfair, unlawful, or fraudulent business practices and misleading advertising. Undisclosed affiliate relationships and deceptive reviews fall squarely within them, and California permits private lawsuits, making it a frequent venue for consumer class actions. The federal clear-and-conspicuous disclosure practice you use for the FTC also satisfies California’s deception standard.
Privacy: CCPA and CPRA
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), is the most far-reaching state privacy law. For affiliates whose sites meet its thresholds, the key duties are:
- Post a privacy policy describing data collection, purposes, and consumer rights.
- Provide a “Do Not Sell or Share My Personal Information” link, because affiliate and advertising trackers commonly constitute a “sale” or “sharing” under the law.
- Honor the Global Privacy Control signal as a valid opt-out.
- Honor rights to know, delete, correct, and limit the use of sensitive personal information.
Automatic renewals
California’s Automatic Renewal Law is among the strictest in the country, and its 2025 amendments tightened it further. If you promote subscriptions or free trials, the merchant must obtain express consent to the renewal, present clear terms, offer easy online cancellation, and send renewal reminders. See automatic-renewal laws for the details, which apply whenever California residents subscribe through your links.
California as your compliance proxy
If you build to California’s standard — clear disclosure, a genuine privacy opt-out with GPC support, and careful handling of subscription offers — you will satisfy the core requirements of most other states without tracking each one separately.
Related: state privacy laws and cookie consent obligations.
Authoritative sources
Last reviewed July 2026. This page is general educational information, not legal or tax advice.