What California Law Actually Requires of a San Francisco Website

Most agencies pitching a San Francisco business talk about design systems and page speed. Those matter. But in California the largest avoidable cost in a web project is usually legal, and it lands on the page itself: a missing link in the footer, a pixel that fires before consent, a cancel flow that routes to a phone number, a hiring page with no salary range. That is a front end problem, and it belongs in the scope of work before a line of code is written.

Privacy is a build requirement, not a plugin

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is enforced by the California Privacy Protection Agency and the state Attorney General. It covers a for-profit business doing business in California that meets any one of three tests: annual gross revenue above the inflation-adjusted threshold, currently 26,625,000 dollars; buying, selling or sharing the personal information of 100,000 or more California residents or households in a year; or deriving half or more of its revenue from selling or sharing personal information. Nothing in that list requires the company to be headquartered in California, or in the United States.

The 100,000 consumer test catches people out, because third party advertising cookies on a high traffic site can put a mid-sized company over the line without anyone realising.

What has to exist on the page

• A clear and conspicuous Do Not Sell or Share My Personal Information link from the homepage, plus a Limit the Use of My Sensitive Personal Information control where sensitive data is processed
• Honouring the Global Privacy Control signal automatically, on page load, with no second click from the visitor
• A notice at collection shown at or before the point of collection, not buried in the privacy policy
• Working request intake for access, deletion and correction, including for job applicants, who are covered consumers
• A privacy policy satisfying the older California Online Privacy Protection Act, which still requires a statement of how you respond to Do Not Track signals

The CPPA has been enforcing, not warning. Its published settlements include 632,500 dollars with American Honda Motor Co. in March 2025, roughly 345,000 dollars with Todd Snyder Inc. in May 2025 over broken opt-out handling, and 1.35 million dollars with Tractor Supply Company in September 2025, which also required quarterly scanning of the company's own digital properties. Those turned on mechanics a developer controls.

The agency's rules on dark patterns also mean the consent interface is judged on its visual design. A prominent Accept All next to a muted or hidden decline option is treated as an invalid consent flow. Your designer decides whether you pass that test.

The wiretapping claims that target ordinary analytics stacks

The California Invasion of Privacy Act is a 1960s wiretapping statute, and plaintiffs' firms now use it against ordinary website tracking. Session replay scripts, chat widgets and advertising pixels are the recurring targets. The theory is aimed squarely at implementation: a visitor arrives, third party scripts fire immediately, and the consent banner is still rendering when the data leaves. Section 637.2 of the Penal Code lets a private plaintiff seek the greater of 5,000 dollars per violation or treble actual damages, which is why demand letters arrive in batches.

A cookie banner sitting on top of a tag manager that has already fired does not solve this. Consent gating in the code does: scripts held until a signal exists, server side tagging where it helps, and an inventory of every third party the site loads. Ask any agency quoting you what happens in the first 300 milliseconds after a page loads.

Accessibility carries a price tag in California specifically

Title III of the Americans with Disabilities Act reaches websites tied to places of public accommodation. California adds the part that changes the maths. The Unruh Civil Rights Act treats an ADA violation as an Unruh violation and carries minimum statutory damages of 4,000 dollars per offence, plus attorney's fees, and Unruh claims have been brought against businesses outside the state whose sites serve California residents.

There is no official technical standard for private businesses under Title III. In practice courts and settlement agreements point to WCAG 2.1 Level AA, the same standard the Department of Justice set for state and local government sites in its 2024 Title II rule. Build to it during development: keyboard traps, missing form labels, invisible focus states and unlabelled icon buttons are cheap to avoid and expensive to retrofit. Overlay widgets do not settle these cases.

If you sell a subscription, the cancel flow is regulated

California's Automatic Renewal Law, amended by AB 2863, applies to contracts entered into, amended or extended on or after 1 July 2025. If a customer can start a recurring service online, they must be able to end it online, at will, without extra steps that obstruct or delay cancellation. The statute contemplates a prominent direct link or button, which may sit inside the account area or settings, or a ready to send termination email. Save offers are allowed, but a click to cancel control has to sit prominently beside them. Free trials that convert to paid are inside the definition.

The FTC's revised Negative Option Rule was vacated by the Eighth Circuit in July 2025, so that federal click to cancel rule is not in force. The Restore Online Shoppers' Confidence Act and Section 5 of the FTC Act still are, and the California statute binds a San Francisco business either way.

Sector regulators that reach into page content

San Francisco's economy concentrates in exactly the industries where the regulator reads the marketing copy.

• Investment advisers and broker-dealers. SEC Rule 206(4)-1, the Marketing Rule, governs adviser advertising including websites, testimonials and performance figures. FINRA Rule 2210 treats a broker-dealer website as retail communication subject to principal approval and recordkeeping, so content workflow and version history become compliance infrastructure.
• Digital health, and anything touching Mission Bay. HIPAA and California's Confidentiality of Medical Information Act constrain what a pixel may observe on an appointment or symptom page. Advertising tags on authenticated patient pages are a known litigation area.
• Generative AI developers. California AB 2013 requires developers of generative AI systems made available to Californians to post training data documentation on their own website from 1 January 2026: sources, ownership, rough volume, whether copyrighted or personal information is included, and use of synthetic data. The separate AI Transparency Act, SB 942 as amended by AB 853, became operative on 2 August 2026 for providers above one million monthly users.
• Physical products sold online. Proposition 65 warnings must reach the buyer before purchase completes, meaning the product display page, not the packaging alone.

Careers pages are regulated pages

Two rules apply to the same template. California SB 1162 requires employers with 15 or more employees to include the pay scale in job postings, and to pass that scale to any third party posting on their behalf. The San Francisco Fair Chance Ordinance, enforced by the city's Office of Labor Standards Enforcement, requires job advertisements likely to reach San Francisco applicants to state that the employer will consider qualified applicants with arrest and conviction records. Both the salary field and that boilerplate line need to exist in the CMS, not in a copywriter's memory.

Building for San Francisco from outside it

FuturByte works from Dubai, eleven hours ahead of Pacific Time in summer and twelve in winter. Decisions made in a San Francisco afternoon get picked up the same night in Dubai and land before the next morning stand-up. That works when the overlap is scheduled rather than assumed, and the approval path is one named person.

A few local realities worth designing for. San Francisco is genuinely multilingual, with Chinese, Spanish, Filipino and Russian speaking communities large enough that a consumer facing site often needs more than English. Payments run to cards, Apple Pay and ACH in US dollars, and with Stripe and Block both headquartered here, local buyers know those checkout patterns. Traffic skews to recent iPhones on fast connections, which tempts teams into heavy pages, and then the same site is opened underground on BART.

None of this is legal advice. It is a scoping list. Take it to your counsel, then take the answers to whoever is building the site.

The pattern in every item here is the same. California puts obligations on the interface, and interfaces are built by developers. A site scoped with the opt-out link, the consent gate, the accessibility standard, the cancel button and the hiring fields treated as requirements costs a little more up front and far less later. If you are planning a build or a rebuild for a San Francisco business, tell us about the project.