Technically, yes: California's CCPA is an opt-out law, so tracking by default with a clear way to opt out is allowed, and many sites run it that way. But there's a trade-off worth understanding. The demand letters going around small businesses tend to rely on a different rule, a wiretapping theory (CIPA), that turns on data being transmitted in the first place, regardless of cookies. A track-by-default setup transmits before anyone opts out, which is the exposure those firms target. A block-until-consent setup avoids it but gives up some measurement on people who don't agree. Neither is automatically "right"; it depends on where your visitors are and how cautious you want to be. We'll lay out both plainly and set up whichever you choose, rather than quietly picking the riskier one for you.