CPPA Board Opens Rulemaking on Opt-Out Preference Signals and Plans Regulatory and Legislative Agenda

Do you want to receive these privacy recaps in your inbox each week? Subscribe here or follow us on LinkedIn.

This week, the California Privacy Protection Agency board voted to open formal rulemaking on opt-out preference signals, with new examples on cookie syncing, cross-device tracking and timing, plus a new rule for browsers. The board also approved staff recommendations on privacy notices and on reducing friction in exercising privacy rights, and authorized staff to work toward sponsoring a bill next session in one of four areas.

These came out of the Agency’s quarterly board meeting, which produced three notable developments. Below, we look at each one and what it means for how businesses handle opt-outs and notices.

United States

Opt-Out Preference Signal (OOPS) Rulemaking

The board voted to open formal rulemaking on opt-out preference signals and other changes, with a 45-day public comment period to follow. The proposed amendments would do the following:

• GPC: The rules would name Global Privacy Control as an example of a qualifying signal.
• New illustrative example – cookie syncing: A business that receives a signal must configure its website to prevent third parties from initiating or performing cookie syncing for cross-context behavioral advertising.
• New illustrative example – cross-device tracking: A business that links a consumer’s devices into a pseudonymous profile and sells or shares that information must apply an opt-out received on one device to every device linked to that profile, while a business that keeps information in unlinked, device-specific form is not required to extend the opt-out beyond the device that sent it.
• New illustrative example – timing: A business must determine whether it has received an opt-out preference signal before it sets cookies or loads other technologies that sell or share personal information. A business whose consent management platform and tag manager check for a GPC signal only after third-party advertising and analytics tags have fired fails to honor the opt-out as soon as feasibly possible.
• New rule for browsers: A browser feature that interacts with a business on the consumer’s behalf, and makes the consumer’s personal information available to that business, would be prohibited from preventing or interfering with the consumer’s opt-out preference signal.
• Metrics reporting: The request metrics that large businesses publish in their privacy policies would extend to businesses that must conduct a cybersecurity audit or risk assessment, and every business subject to metrics reporting would have to disclose how many opt-out requests arrived through a preference signal.

Takeaway

The Agency describes these amendments as clarifying existing obligations, and the examples bear that out by tracking positions California enforcers have already taken. 

The cross-device examples reflect the principle from the Attorney General’s Disney case, that a business able to associate a consumer’s devices for advertising “can and must” do so to honor opt-outs, and the Attorney General’s recent Lyft settlement similarly required opt-outs, including those sent through GPC, to be applied across a consumer’s account and any pseudonymous profiles tied to the consumer’s browser or device. 

The timing matters too. California’s Opt Me Out Act, which requires browser developers to offer GPC, takes effect January 1, so businesses are likely to receive far more GPC signals just as these examples spell out how enforcers expect them to be honored. The new browser rule complements that law by keeping browser features that act on a consumer’s behalf from undercutting the signal.

Notices, Disclosures and Friction in Exercising Rights

The board approved staff’s preliminary recommendations on notices and disclosures and on reducing friction in the exercise of privacy rights, directing staff to turn both into draft rulemaking text, which is expected in February. The recommendations include:

Notices and disclosures:

• Short notice: A short notice at the top of the privacy policy with definitive, “nutrition label” statements on whether personal information is sold or shared, whether sensitive data is used and whether automated decision-making technology is used, plus direct links to rights portals and readability guidance.
• Clearer disclosures: Guidance that privacy disclosures require a definitive statement on whether personal information was sold or shared, rather than one hedged with “may”; retention periods tied to purpose, rather than “as long as necessary”; and descriptions of categories of personal information that give consumers a meaningful understanding of what is collected.
• Prior privacy policies: A requirement for businesses to publish prior versions of their privacy policy.
• Financial incentives: A requirement for the notice of financial incentive to include the consumer-facing name and URL of the program.
• Purpose limitation: New examples of how disclosures fit within the CCPA’s purpose limitation and data minimization requirements.

Reducing friction:

• Consumer tool and sample webform: The Agency would provide a tool to help consumers submit a single request covering all applicable rights, and a sample webform for businesses (optional, with no safe harbor).
• Cookie controls: Businesses that use cookie controls to provide opt-out of sale or sharing would have to explain how cookie preferences relate to that opt-out.
• Prohibited practices: Practices that make rights hard to exercise, such as making rights information hard to find, failing to promptly fix nonfunctional links and requiring unnecessary steps, would be expressly prohibited.
• “Intentionally interacts”: The CCPA’s exclusion from the definitions of “sale” and “sharing” for when a consumer uses or directs the business to intentionally disclose personal information to, or intentionally interact with, a third party would be clarified. Staff would add that a consumer has not directed a business to disclose personal information to, or interact with, a third party unless the direction identifies the third party, the specific purpose of the disclosure or interaction, and how long it will last.
• Withdrawing consent: Businesses would have to make it easy to review and withdraw consent, with symmetry in choice, and explain how to do so in the privacy policy.
• Confirming receipt: Businesses would have to confirm receipt of verifiable requests as soon as feasibly possible, within 10 days.

Separately, preliminary recommendations on employee data are expected in February.

Takeaway

The February packages will not be final rules. They will be draft text for the board to review, and if the board advances them, a public comment period could open next spring, with the rules still subject to change before adoption. Much of the friction package, though, puts in writing positions the Agency has already taken through enforcement. Its settlements with Honda and Todd Snyder involved demanding more personal information than necessary and, in Honda’s case, failing to offer privacy choices symmetrically, and its actions against Tractor Supply and PlayOn Sports involved failing to honor GPC or to provide an adequate opt-out method. 

The cookie-controls recommendation also echoes the Attorney General’s recent Lyft settlement, which requires the company to avoid language and choice architecture that could lead consumers to believe a cookie setting is either required to opt out of sale or sharing or is itself an opt-out. That recommendation’s usefulness is limited, however, by what it leaves out. Many companies put cookie banners in place to manage exposure under CIPA rather than the CCPA, and staff indicated at the meeting that the recommendations will not address how cookie controls interact with CIPA. 

Guidance on how a banner relates to the CCPA opt-out that does not account for the CIPA consent the same banner is often designed to capture may not resolve the questions businesses actually face in configuring it.

Legislative Priorities

Staff indicated it has the resources to work toward sponsoring only one bill next session. Because the board will not meet again until February, it did not choose among the proposals and instead authorized staff to work toward sponsorship in any of four areas, giving staff flexibility to change focus if needed:

• Making advertising IDs accessible to consumers and letting them reset, deactivate or delete those IDs.
• Requiring clear notice and consent for automated content recognition on connected TVs.
• Requiring consent to use personal data to train AI and limiting manipulation.
• Prohibiting consumer wearable recording devices, such as smart glasses, from collecting or using biometric data or integrating facial recognition, with exceptions for assistive technology and certain other uses.

Takeaway

All four would be new for California, but only ACR has a direct model elsewhere: Kentucky has amended its comprehensive privacy law to bar collecting ACR data without consent, effective July 1, 2027, and the Texas Attorney General’s settlements with Samsung and LG require the same. 

For the other three, staff proposes going beyond existing precedent. Opt-in consent for AI training would exceed prior failed California bills limited to children’s or employees’ data. Staff was not aware of any prior California proposal on advertising IDs, now governed only by platform settings. And while Illinois’s BIPA and Washington’s My Health My Data Act require consent to collect biometric data, a ban on wearable recording devices collecting or using it would go further, reaching bystanders whom consent laws miss.

A Little More Privacy, if You Please

• CJEU Advocate General Says Dynamic IP Addresses Can Constitute Personal Data in Google Fonts Case
• CNIL Issues Recommendations for Session Replay Tools That Track User Behavior
• Privacy in the age of AI agents: My thoughts for the last stretch of 2026 by Romain Gauthier
• What is the MSPA? Insights from our webinar with the IAB by Michael Lanoie 
• Apple ATT in iOS 27.2: What changes for mobile apps?

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.