CPPA Proposes Amendments to Opt-Out Preference Signal Regulations

The California Privacy Protection Agency (“CPPA” or “Agency”) staff has released a package of proposed amendments to the California Consumer Privacy Act (“CCPA”) regulations governing opt-out preference signals (“OOPS”). The proposal would expressly identify the Global Privacy Control (“GPC”) as an example of a signal that businesses selling or sharing personal information must process as a valid opt-out request, add new illustrative examples addressing when a business must process the OOPS signal as a valid sale/share opt-out, and expand the CCPA’s metrics-reporting obligations. The revised text, together with a staff recommendation that the CPPA Board advance the package to formal rulemaking and open a 45-day public comment period, is expected to be taken up at the Board’s November 5–6 meeting.

As we previously reported, the CPPA finalized updates to its existing CCPA regulations last year. The OOPS proposals build on that framework and, notably, tie several new obligations to already-adopted audit and assessment requirements. We summarize the background and key amendments below.

Background

At its November 7, 2025 meeting, the Board directed staff to conduct preliminary rulemaking activities on OOPS. According to the rulemaking materials, staff conducted stakeholder outreach, reviewed 376 pages of public comments, examined enforcement experience, and performed a state-by-state analysis of “universal opt-out mechanism” laws in other states. Staff presented its findings at the Board’s August 6–7, 2026 meeting, after which the Board instructed staff to prepare the materials necessary to open formal rulemaking.

The Agency frames the problem in enforcement terms: the Initial Statement of Reasons states that, since 2020, enforcement actions by the Agency and the California Attorney General “have demonstrated that many businesses fail to detect, honor, or properly implement” OOPS. The Agency also indicates that the additional guidance is meant to reduce businesses’ confusion about compliance obligations. The proposal arrives as the Agency-sponsored Opt Me Out Act, which requires browser developers to offer GPC functionality, is set to take effect on January 1, 2027.

Key Amendments

Express recognition of GPC. The proposal lists GPC as an example of a commonly recognized signal.

Browser features must forward the signal. Browser features that interact with businesses on a consumer’s behalf and make personal information available “must not prevent, interfere with, contradict, or disable” the consumer’s OOPS from being sent.

Metrics reporting. Annual metrics reporting—currently limited to businesses handling the personal information of 10,000,000 or more consumers—would extend to any business required to complete a cybersecurity audit or risk assessment, and covered businesses would separately report opt-out requests received through an OOPS.

Clarifying revisions. Technical clean-up changes would be made to sections 7060, 7122, 7124, 7157, 7221, and 7222. These changes include adding a “to the best of my knowledge” qualifier as part of the cybersecurity audit attestation. The Agency concluded that the economic impact of the proposal will not be significant. According to the Initial Statement of Reasons, the only amendments expected to result in measurable cost are the expanded metrics-reporting requirements.

New Illustrative Examples

New examples signal how the Agency expects businesses to operationalize existing obligations:

• Cookie syncing. A business that receives an OOPS must prevent third-party trackers on its site from initiating or performing cookie syncing for cross-context behavioral advertising.
• Pseudonymous, cross-device profiles. A business that links a consumer’s devices into a pseudonymous profile (e.g., via fingerprinting) must apply a GPC signal from one device to all linked devices.
• Unlinked data. A business that keeps data in unlinked, device-specific form need apply the signal only to that device and need not collect additional information to link devices.
• Timing of signal detection. Because GPC arrives with the browser’s initial request, a business must check for the signal before any cookies or pixels that sell or share personal information activate.

Next Steps

Agency staff recommends that the Board advance the draft regulations to formal rulemaking and initiate the 45-day comment period. If the Board votes to proceed, the draft Notice of Proposed Rulemaking contemplates a public hearing and written comment period (dates to be set), and any sufficiently related modifications would be made available for an additional 15-day comment period before adoption.

Staff has separately presented recommendations to the Board on reducing friction in the exercise of privacy rights (including clarifying how intentional interactions and cookie preferences relate to opt-out of sale/sharing) and on notices and disclosures. These topics may proceed on separate tracks.