Guides
How CCPA and CPRA change the viewer analytics a US YouTube channel may keep
California privacy law decides how long a US YouTube channel may hold viewer analytics, and what it must tell California viewers before collecting it.
What to take away
- A channel that sells ads or sponsorships and reaches California viewers holds consumer data under the CCPA and CPRA, not just marketing exhaust.
- The CPRA added a right to correct, a right to limit sensitive personal information, and a duty to honor opt-out of sale or sharing requests.
- Retention must be tied to a disclosed purpose and a stated period, then deleted or de-identified. Storage cost is not a reason to keep records.
- GA4 and YouTube Studio are service provider flows, but you still need a contract and a setting check that your data is not used for Google's own advertising.
- The California Attorney General enforces the CCPA and runs compliance sweeps, so keep your notices, request log and deletion proof current.
What CCPA and CPRA cover when a channel collects viewer analytics
The California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General applies to for-profit businesses that do business in California and meet one of several thresholds.
Does CCPA Apply to Your Channel?
Gross annual revenue above $25 million?
CCPA applies
Check next threshold
The two that catch channels are gross annual revenue above 25 million dollars, and buying, selling or sharing the personal information of 100,000 or more consumers or households.
A mid-sized channel with a large email list, a merchandise store and ad retargeting can cross the second line without ever approaching the first.
The CPRA amended the CCPA through a ballot measure that took effect at the start of 2023. It created the California Privacy Protection Agency and added rights to correction and to limits on sensitive personal information.
The statutory text of CCPA as amended by CPRA is the controlling language. Read it before you rewrite a privacy policy.
For a channel, the relevant data is broader than a subscriber email. It includes watch history tied to an account, comment text, device identifiers, IP addresses, cookie IDs and the audience segments you build in a dashboard.
A viewer who watches from California is a California consumer even if your studio is in Austin or Tampa. Where you sit does not decide who is protected.
The Attorney General publishes a plain-language overview of CCPA obligations covering notice at collection, the right to know, the right to delete and the right to opt out of sale or sharing. Read it before deciding you are too small to matter.
Are YouTube channel analytics personal information under the CPRA?
Most of it is. The CPRA defines personal information as data that identifies, relates to, describes or could reasonably be linked to a particular consumer or household. A viewer ID tied to watch sessions, a hashed email used for custom audiences, and a device graph all qualify.
Is This Analytics Personal Information?
Can you answer a deletion request from this table?
Personal information, schedule retention
Likely aggregate, lower exposure
Aggregate numbers are the exception. A count of views by country, with no identifier and no reasonable path back to a person, is not personal information. Slice that count by cohort and join it to a CRM record, and it becomes personal information again.
This changes how you build reports. A audience analytics workflow that keeps raw event rows with user IDs for years holds personal information. One that keeps only de-identified rollups carries far less exposure.
One test settles most cases: could you answer a deletion request for this viewer from this table? If yes, the table holds personal information and belongs in your retention schedule.
Notice, opt-out and the sharing of audience data
Notice at collection must be given before or at the point you collect. For a channel that means a privacy link in the video description, on the channel About page, and on any landing page where you run a pixel or a lead form. The notice lists the categories collected and the purposes.
Where to Place Privacy Links
Strong placement
- Notice at collection
- Before or at collection
- Opt-out link
- Site footer
- Pixel pages
- Every page with tracking
- GPC signals
- Honored automatically
Weak placement
- Notice at collection
- After collection
- Opt-out link
- YouTube description
- Pixel pages
- Only homepage
- GPC signals
- Ignored
Opt-out of sale or sharing is the right most channels get wrong. Sharing includes disclosing personal information for cross-context behavioral advertising even when no money changes hands. A Meta pixel or a Google Ads remarketing tag on your own site can count as sharing.
The required link text is Do Not Sell or Share My Personal Information. Put it where a California viewer finds it without hunting. A footer link on your site is the usual answer; a YouTube description is weaker but still worth adding.
If you sell or share data, honor opt-out preference signals such as Global Privacy Control. Do not require a viewer to create an account to opt out, and do not degrade the service in retaliation.
Notice, opt-out and sharing
| Obligation | What it means for a channel |
|---|---|
| Notice at collection | Disclose categories and purposes before you collect |
| Right to know | Provide the specific pieces of data you hold on a viewer |
| Right to delete | Delete and tell service providers to delete |
| Right to correct | Fix inaccurate viewer records on request |
| Opt-out of sale or sharing | Honor the link and GPC signals |
| Limit sensitive data | Restrict precise geolocation and similar data |
Retention limits and data minimisation for viewer records
The CPRA added a data minimisation principle. You may collect, use and retain personal information only as reasonably necessary and proportionate to the purposes you disclosed. That ends the habit of keeping every event row because storage is cheap.
Suggested Retention Periods by Data Type
- Raw analytics events14 months
- Aggregated reports36 months
- Suppression listsas long as needed
Retention limits mean stating how long you keep each category and then deleting it. A defensible schedule might keep raw analytics events for 14 months, aggregated reports for 36 months, and suppression lists for as long as honoring the request requires.
Do not keep identifiers in a backup indefinitely because the backup is inconvenient to edit. If a viewer asks for deletion and the record sits in an old export, that export is in scope. Rotate backups on a schedule you can describe out loud.
Minimisation also governs what you ask for. A channel collecting full name, phone number and postal address to send a newsletter collects more than the purpose requires. Take the email, say why, and delete it when the subscriber leaves. The youtube channel analytics you keep monthly should follow the same rule.
- Categories of viewer data mapped, with a purpose written next to each
- Retention period stated for raw events, reports and backups
- Deletion process that reaches exports, CRMs and ad platforms
- Opt-out link live on every page that runs a tracking pixel
- Service provider contracts include CCPA and CPRA terms
- Request log with dates, actions and the person who handled it
- Annual review of tags, pixels and audience segments still in use
Service providers, GA4 and YouTube Studio data flows
Google Analytics 4 uses an event-based measurement model that combines app and web streams, which is why one user can appear across a site and an app. That cross-platform view is useful for a channel and is exactly the linkage the CPRA cares about.
Who Controls Which Viewer Data
- YouTube Studio: YouTube is controller
- GA4: Google is service provider
- Your CRM: you are controller
- Exports and custom audiences: you are controller
- Write down where systems meet
When Google processes data on your behalf under your instructions, it is a service provider. You still need a written contract with the required terms, and you must confirm in the settings that the data is not used to build Google's own advertising profiles. Check the setting rather than assuming it.
The next generation of Analytics documentation explains the measurement model and the controls that exist. Read it beside your own tag setup so your privacy notice describes the flow accurately.
YouTube Studio data is different. YouTube is the controller of most platform data and you see it through a dashboard. Your obligations attach to what you export, join or store outside the platform, such as a subscriber list or a custom audience file.
A clean split helps: keep platform reporting inside YouTube, keep first-party data in systems you control, and write down where the two meet. The platform and distribution guide covers how those surfaces fit together.
California AG enforcement and what creators should document
The California Attorney General has enforcement authority and can seek civil penalties, including penalties per violation and per request handled badly. The office also runs a privacy sweep program that sends notices about compliance gaps, often before any formal action.
The California Department of Justice privacy and data security pages describe that enforcement role and the rights consumers can exercise. Knowing what the office looks at tells you what to keep on file.
Enforcement usually starts with a complaint or a sweep. The first thing a reviewer asks for is your notice, then your request log, then proof that deletions reached your vendors. If you cannot produce those, the argument about intent rarely helps.
Keep documentation boring and current. Start with a data map and a retention schedule. Include each version of your privacy notice with its live date. Also keep a log of every request with the outcome:
Enforcement Documentation Checklist
- Data map with purposes
- Retention schedule
- Every privacy notice version with live date
- Request log with outcomes
- Proof deletions reached vendors
A worked example
A California-based cooking channel runs a recipe site with a GA4 tag and a Meta pixel. It keeps a 40,000-address newsletter list in a CRM and builds lookalike audiences from it.
Step 1: The channel maps data. Site events, pixel events, CRM records and exported Studio reports all hold personal information.
Step 2: It writes a notice at collection and adds a Do Not Sell or Share link to the site footer, since the pixel counts as sharing.
Step 3: It sets retention at 14 months for raw events and 36 months for aggregates, then configures GA4 and the CRM to enforce both.
Step 4: A viewer emails a deletion request. The channel verifies, deletes from the CRM, forwards the request to the email vendor and the ad platform, and logs the date and action.
Step 5: It reviews tags quarterly, because a forgotten pixel is the most common source of a stale sharing disclosure.
What to do next
- Decide whether your channel meets a CCPA threshold, and write the answer down.
- Map every place viewer data lands, including exports and audience files.
- Publish a notice at collection and an opt-out link, then test both.
- Set retention periods and configure the tools to enforce them.
- Sign service provider terms with GA4, your CRM and your ad platforms.
- Log every request and review the whole setup once a year.
California is not alone. Washington, Colorado, Connecticut and Virginia have their own privacy statutes with different thresholds and rights, so one national process is usually cheaper than patching per state.
Expansion decisions in the best markets for a youtube channel should carry a privacy cost line, and the youtube channel kpis you review each month should include privacy request volume.
This is not tax, legal or data-protection advice for your channel. Retention periods, thresholds and notice wording vary by jurisdiction and by what you actually collect. Confirm your position with a licensed privacy attorney and your CPA before you publish a notice or delete a record.
Common questions
Does a small YouTube channel have to comply with the CCPA?
Only if it meets a threshold, such as 25 million dollars in revenue or data on 100,000 consumers or households. Many small channels fall outside both. A channel with a large store or ad operation can cross the second line quietly.
Is watch history personal information?
Usually yes, when it is tied to an account, device or identifier. A de-identified count of views by country is not. The distinction turns on whether you could pull one viewer's record out of the table.
Do I need a Do Not Sell or Share link if I only use GA4?
Often yes, if you also run advertising pixels or build remarketing audiences. GA4 alone is usually a service provider flow, but the surrounding tags decide the answer. Have counsel review your tag setup.
How long can I keep viewer analytics?
As long as you disclosed, and no longer. A common approach is 14 months for raw events and up to 36 months for aggregated reports, with backups rotated on a stated schedule. Set the period with a privacy lawyer, not from a blog post.
