If you have a consent banner, a Do Not Sell link, and a preferences database logging every opt-out, you’re CCPA compliant, right? Not really. In July 2025, Healthline Media settled with the California Attorney General for $1.55 million. That’s one of the largest CCPA fines to date. They had opt-out forms. They had GPC support. They had a preference database. Yet, after users exercised all three, investigators found that 118 cookies were still active and 82 tracking tags were still operating.