How does Feasible handle CCPA?

The CCPA questions mostly don’t attach to us, because the things it regulates aren’t happening.

California’s rules turn on a handful of specific behaviors. Here’s where Feasible lands on each.

Selling personal information. We don’t. Not for money, not for “other valuable consideration”. There’s no data broker, no ad network, no partner feed. The longer answer.

Sharing for cross-context behavioral advertising. This is the one the CPRA added, and it’s the one most analytics scripts trip over. Feasible does no advertising of any kind and builds no audience. Your domain is baked into the visitor hash, so the same person on two of our customers’ sites is two unrelated numbers. There’s no context to cross.

Profiles and automated decision-making. Neither exists. There are no user-level records, no per-person timelines, and no screen anywhere that shows you an individual.

Sensitive personal information. We don’t collect any - unless you send it yourself in a custom property, which the DPA prohibits.

Consumer requests - access, deletion, correction. Because the visitor hash rotates every day and the IP is never written down, there’s usually no way to find a given person’s rows in the first place. That’s a limitation and a feature at once, and it’s the answer to give a requester. Your own account data is different: you can export it or delete it whenever you like.

Do you still need a “Do Not Sell or Share My Personal Information” link because of something else on your site? Possibly. This isn’t legal advice - it’s a description of what our software does. Read the privacy policy, and ask a lawyer about the rest of your stack.