California Privacy Agency Advances Opt-Out Signal Rules
The proposed amendments would expand reporting duties and require browser-based opt-out signals to be honored before cookies are set.
Updated on Nov. 10, 2026 in Advertising
Live Poll
Do you trust companies to honor your online opt-out requests for personal data?
The California Privacy Protection Agency unanimously voted on November 6, 2026 to advance proposed amendments to rules governing opt-out preference signals, browser-based signals that tell websites a consumer has opted out of the sale or sharing of personal information. The agency will open a 45-day public comment period on the changes.
Why it matters
The proposal follows findings by CalPrivacy, the California Attorney General, and state lawmakers that businesses continue to ignore or fall short of requirements the California Consumer Privacy Act already imposes. The amendments are intended to give businesses guidance that improves compliance across California.
The California Privacy Protection Agency estimates roughly 50,000 businesses would fall within the scope of the proposed amendments. The proposal remains open to a 45-day public comment period before any final text is adopted.
The players
California Privacy Protection Agency
The state agency, known as CalPrivacy, that enforces the California Consumer Privacy Act and oversees privacy compliance for businesses operating in California.
Rob Bonta
The California Attorney General who, alongside CalPrivacy, has brought enforcement actions against businesses that made it difficult for consumers to opt out of sharing their personal information.
The details
One amendment expands business reporting requirements to include disclosure of the number of opt-out-of-sale requests received through browser-based preference signals. Another clarifies that online platforms must honor opt-out preference signals before setting cookies or other tracking technologies on their websites.
Timeline
March 2026: CalPrivacy requested preliminary input from consumers and businesses on opt-out preference signals.
Earlier in 2026: Oregon Senator Ron Wyden urged regulators in California, Colorado and other states to investigate businesses failing to honor opt-out requests.
November 6, 2026: The agency unanimously voted to advance the proposed amendments.
A 45-day public comment period on the proposed amendments will follow.
Market Landscape
The proposal extends the California Consumer Privacy Act's existing requirement that businesses honor opt-out preference signals, a rule that has been tested by enforcement actions against companies that made opting out difficult. Trade group TechNet has argued that businesses differ in their capacity to process these signals depending on size and technical infrastructure.
Websites and online platforms serving California users may need to honor opt-out signals before setting cookies or other tracking technologies. Consumers who enable browser-based opt-out settings may see fewer tracking tools activated on the sites they visit.
The takeaway
Consumers who enable browser-based opt-out settings are better positioned to limit data sharing, and businesses that treat these signals as optional face growing regulatory scrutiny. Reviewing how your sites handle opt-out signals now can reduce compliance risk as the rules evolve.
What happens next
CalPrivacy will open a 45-day public comment period on the proposed amendments, after which the agency will consider feedback before any final adoption.
Further reading
Explore more advertising news to see how data privacy rules are reshaping online marketing in California.
Live Poll
Do you trust companies to honor your online opt-out requests for personal data?
