Franchise Website Tracking Pixels: What CCPA and Colorado Opt-Out Rules Require

What happens under California law the moment a franchise website's remarketing tracking pixel sends a visitor's browsing history to an ad-tech vendor, and nobody ever sees a working opt-out link? The transfer counts as a “sale” of personal information under the California Consumer Privacy Act, whether or not any money changes hands, and that triggers a disclosure duty and an opt-out mechanism most franchise privacy policies don't actually meet. Sephora found this out the expensive way: a $1.2 million settlement with the California Attorney General in 2022 over exactly this pattern, running on a retail website that looked no different from a typical franchise location-finder page.

Does running a tracking pixel count as selling customer data?

Under California Civil Code Section 1798.140, “selling” personal information means disclosing a consumer's data to a third party for monetary or other valuable consideration. California's Attorney General has confirmed that giving an ad-tech vendor free analytics in exchange for browsing data satisfies that test, and a franchise site's standard remarketing pixel fits the definition the moment it loads.

That was the finding against Sephora. The company let third-party cookies, pixels and software development kits run across its site and app, letting outside firms build shopper profiles from device type, cart contents and location, in exchange for free or discounted advertising and analytics services. Sephora's actual mistake wasn't running the trackers. It was telling consumers, in its own privacy policy, that it didn't sell their information, which meant the company never offered the disclosure or opt-out the law requires once that exchange counts as a sale. A franchise brand running the identical setup across a location-finder template republished on sixty or six hundred location pages carries the identical exposure, multiplied by every page the template touches.

What the Sephora settlement actually required

The settlement was the first monetary penalty issued under the CCPA, and its terms describe the baseline a franchise network's own location pages have to clear. California's Attorney General required Sephora to pay $1.2 million into the state's Consumer Privacy Fund, rewrite its privacy disclosures to admit the data sales, add a working opt-out mechanism, including recognition of browser-level privacy signals, bring every service-provider contract into CCPA-compliant form, and file annual reports on the arrangement with the Attorney General for two years. None of those obligations required Sephora to stop using tracking pixels. They required Sephora to tell the truth about using them and to let visitors say no.

A franchise network that has never audited whether its own loyalty platform or visitor-tracking vendor shares data the same way is running the same unexamined risk, which is the same underlying question that shows up when a brand switches platforms and discovers nobody defined who legally owns the collected visitor and loyalty data in the vendor contract to begin with.

Why honoring the opt-out click isn't enough

A “Do Not Sell My Personal Information” link in the footer is not the finish line. Under Title 11 of the California Code of Regulations, Section 7025, operative since March 29, 2023, a business that sells or shares personal information must automatically honor an opt-out preference signal broadcast by the visitor's own browser, commonly a Global Privacy Control signal, with no separate click required, no fee charged, and no extra information demanded to process it.

Most franchise websites were built around a cookie-consent banner, not a signal listener. The banner satisfies a visitor who clicks through it. It does nothing for a visitor whose browser is already broadcasting an opt-out signal before the page finishes loading, which is precisely the gap California's enforcement activity has gone looking for since the rule took effect: a pixel that keeps firing and sharing data with the ad-tech vendor regardless of what the browser is telling the site.

Why a single pixel policy doesn't survive multi-state franchising

California is not the only state with an opt-out rule attached to tracking technology, and the rules don't all start on the same day or work the same way. Under the Colorado Privacy Act's implementing rules, a universal opt-out mechanism became mandatory for controllers on July 1, 2024, requiring businesses to honor a recognized signal for both targeted advertising and data sales, on a different effective date than California's own March 2023 rule and under a different definition of what counts as a sale in the first place. A franchise network with locations in both states is running two different compliance clocks off one shared website template, which is the same patchwork problem that already complicates a single card-surcharge policy applied network-wide: what satisfies the law in one state can quietly violate it in the next one over.

How much could an unhonored opt-out actually cost a franchise network?

The statute lets California's regulator assess up to $2,500 for each violation, or $7,500 for each intentional one, treating separate affected consumers as separate violations rather than one infraction. Run that formula across even a modest multi-location franchise site, and the arithmetic moves past a line item most franchise insurance programs were ever sized to absorb.

Here is the math, worked through as an illustration rather than a prediction. Assume a 60-unit franchise network's combined location pages draw 120,000 monthly visitors network-wide, and assume, purely for this example, that 15 percent of that traffic originates in California: 120,000 times 0.15 equals 18,000 California visits a month. Over one calendar quarter, that is 18,000 times 3, or 54,000 California visits exposed to a pixel that never honored an opt-out signal. At the standard per-violation ceiling under Civil Code Section 1798.155, 54,000 times $2,500 comes to $135,000,000 in theoretical exposure. If the same failure continued after the operator had already been put on notice, which pushes the rate to the intentional-violation ceiling, 54,000 times $7,500 comes to $405,000,000.

Those are statutory ceilings, not forecasts, which is exactly why Sephora's real settlement landed at $1.2 million instead of nine figures. But the gap between the ceiling and the real number is the actual lesson for a franchise network: regulators set the maximum high enough that a settlement figure which sounds survivable still represents a steep discount from their side of the table. A network carrying cyber or errors-and-omissions coverage sized for a six-figure claim is underinsured against the number the statute actually permits, and that gap is also where liability tends to land on whichever entity in the system already carries the cost of a data incident once something goes wrong.

Building a pixel audit before the next sweep

Three checks cover most of the exposure described above. First, open the browser's network tab on a live location page, enable a Global Privacy Control signal, and confirm the remarketing pixel actually stops firing rather than continuing to send data in the background. Second, pull the privacy policy and confirm it discloses, in plain language, that visitor data is shared with advertising and analytics vendors for consideration, since a policy that still says “we do not sell personal information” while a pixel is live is the exact sentence that cost Sephora its settlement. Third, pull every vendor contract tied to that pixel and confirm it contains the service-provider terms California now requires, not boilerplate written before the rule existed.

Any vendor providing that visibility, including Revscale's web pixel agent, becomes a data recipient the moment its script loads on a franchise tracking pixel page, which makes the opt-out question as relevant to a vendor contract as uptime or price. Run the test above on your own location pages this week. If the pixel keeps firing after the signal is sent, you found the finding before a regulator's sweep does.

This is general information, not legal, tax or financial advice; confirm specifics with a qualified advisor.