Contributors

Related

CalPrivacy held its final board meeting of 2026 on November 5 and 6.  The Board unanimously voted to commence formal rulemaking on the Opt-Out Preference Signal rules, which are discussed in more detail below. 

A redline text of the applicable sections where changes are proposed is available at: Proposed Text: Opt-Out Preference Signals (OOPS). 

California already requires companies to honor opt-out preference signals or OOPS (also known as universal opt-out mechanisms under other state privacy laws). OOPS are browser-based signals that allow consumers to signal to any website (without interacting with each consent management platform or cookie preference center) that they are opting out of sale or sharing of their data for cross-context behavior advertising. Despite the existing requirements, California regulators continue to investigate companies who either are not following the requirements at all or fail to meet all of California’s requirements (including as recently as November 10 when CalPrivacy announced its settlement with a logistics company). 

The bulk of the proposed regulations would provide more technical requirements for OOPS.  In addition, the proposed regulations would lower the thresholds for companies required to publicly post their data subject rights metrics for the prior calendar year and require in-scope companies to specifically disclose their OOPS opt-out metrics. 

More Details on Opt-Out Preference Signals

  • Recognize GPC as a technical standard for OOPS.  California would move to expressly recognize Global Privacy Control (GPC) as an approved opt-out preference signal (other states such as Colorado have already codified this). 
  • New express technical requirement related to cookie syncing. Where a business allows third parties to place cookies on its website to track consumers’ activity across off-platform sites and applications for cross-context behavioral advertising, and those third parties engage in cookie syncing (they match their respective user IDs to identify the same consumer across browsers or devices and enhance the consumer's ad-targeting profile), if the website detects GPC, the business must configure the website so that it does not allow third parties to initiate or perform cookie syncing. 
  • New express technical requirement to detect OOPS before firing third-party advertising and tracking cookies.  Businesses using a consent management platform (CMP) and a tag management system (TMS) on its website must configure their website to first determine if they have received an OOPS before allowing third-party advertising and analytics cookies and pixels that facilitate the sale or sharing of personal information to fire.  If a business configures its website to allow those cookies and pixels to fire first (and therefore completing a sell and share personal information) before determining whether it has received a consumer’s OOPS, then the business has not complied with her request as soon as feasibly possible in violation of existing California regulations.
  • New express technical requirement re: use of matching technologies to link devices and create pseudonymous profiles.
    • Where a business uses tracking technologies to recognize the same consumer across various websites, mobile apps and digital platforms (e.g., a consumer views a product on a business website on a laptop and later visits the same website on their phone and the business is using matching technologies, like fingerprinting, to link those devices and create a pseudonymous profile, even without user logging in or sharing their name), and the business detects an OOPS on one device (e.g., on laptop) it must honor that opt out across all other devices (e.g., phone) or platforms linked to that pseudonymous profile. 
    • If the business does not use tracking technologies to recognize or link the consumer across platforms and maintains consumers’ information in unlinked and device-specific forms only, then the business is not required to extend an opt-out request sent via OOPS to other devices or browsers. 

Updates to Threshold for Metric Reporting & Disclosures for Opt-Outs (Expanding Companies In-Scope for Metrics Reporting & Expanding Disclosure Obligations)

Currently, companies that process information of 10 million or more California consumers in a year must post data subject rights metrics for the prior year. The revised proposal would maintain the current threshold and add two new thresholds: (1) if a business is required to complete a cybersecurity audit or (2) if a business is required to complete a risk assessment. In addition to lowering the thresholds for public posting, the proposed rules would require businesses to separately list the number of opt-out requests received via OOPS.

Next Steps

After the proposed regulations are formally published to the California Regulatory Notice Register and CalPrivacy’s regulations portal, the proposal will be subject to an initial 45-day public consultation with 15-day consultations for subsequent draft changes. Businesses subject to the CCPA should review from a technical perspective how their digital properties currently detect and honor opt-out preference signals and their recordkeeping practices. 

As part of that review, companies should look closely at the timing of when signals are honored and when cookies and other tracking technologies are fired on their properties. They should also look at logging practices to see if they have the data required to meet the expanded reporting obligations.

Learn more about Womble’s Privacy and Cybersecurity and AI teams.