Technically, yes: California's CCPA is an opt-out law, so tracking by default with a clear way to opt out is allowed, and many sites run it that way. But there's a trade-off worth understanding. The demand letters going around small businesses tend to rely on a different rule, a wiretapping theory (CIPA), that turns on data being transmitted in the first place, regardless of cookies. A track-by-default setup transmits before anyone opts out, which is the exposure those firms target. A block-until-consent setup avoids it but gives up some measurement on people who don't agree. Neither is automatically "right"; it depends on where your visitors are and how cautious you want to be. We'll lay out both plainly and set up whichever you choose, rather than quietly picking the riskier one for you.

Worth knowing: this theory is contested. Courts have gone both ways, and legislation moving through the California legislature could narrow part of it. We're not going to tell you a lawsuit is inevitable. What we can tell you is which configuration choices reduce your exposure and what each one costs you in measurement.