Privacy Agency Proposes Opt-Out Signal Rules

Draft amendments to California's CCPA would clarify how businesses must honor opt-out preference signals such as the Global Privacy Control.

Updated on Nov. 4, 2026 in Advertising

Privacy Agency Proposes Opt-Out Signal Rules

Live Poll

Do you trust companies to honor your online privacy opt-out choices?

Staff at the California Privacy Protection Agency released proposed amendments to CCPA opt-out preference signal regulations. The Board will consider advancing the package to formal rulemaking at its November 5-6 meeting.

Why it matters

Enforcement actions since 2020 have shown that many businesses fail to detect, honor, or properly implement opt-out preference signals, and the proposal aims to reduce compliance confusion. The changes would also extend annual metrics reporting obligations to any business required to complete a cybersecurity audit or risk assessment.

Staff reviewed 376 pages of public comments on the draft, and the current annual metrics reporting threshold of 10,000,000 consumers would be broadened under the proposal. Final rule text and the timing of the public hearing remain unsettled pending Board action.

The players

California Privacy Protection Agency

The state agency responsible for enforcing and writing rules under the California Consumer Privacy Act, and the body whose staff released the proposed amendments.

The details

The proposal names the Global Privacy Control as an example of a valid opt-out signal and adds examples on when a business must treat such a signal as a valid sale or share opt-out. It also states that browser features interacting with businesses on a consumer's behalf must not interfere with the opt-out signal being sent.

November 7, 2025: Board directed staff to begin preliminary opt-out signal rulemaking.
August 6-7, 2026: Staff presented findings and the Board instructed preparation of formal rulemaking materials.
November 5-6, 2026: Board meeting to consider advancing the proposed package.
January 1, 2027: Opt Me Out Act browser Global Privacy Control requirement takes effect.

Market Landscape

The proposal builds on the CCPA's opt-out preference signal framework, which has drawn enforcement actions since 2020 against businesses that failed to honor these signals. It arrives alongside the Opt Me Out Act, which requires browser developers to offer Global Privacy Control functionality starting January 1, 2027.

If the proposal is adopted, businesses that collect personal data would need to reliably detect and honor browser-based opt-out signals such as the Global Privacy Control. Consumers who enable those signals could see fewer tracking and sales of their data across sites that comply.

The takeaway

Consumers who want their data kept from sale or sharing can enable opt-out preference signals in their browser, and businesses should review how they detect and honor those signals before formal rules take effect.

What happens next

The CPPA Board will consider advancing the proposed package to formal rulemaking at its November 5-6, 2026 meeting, and the Opt Me Out Act's browser requirement takes effect January 1, 2027.