California regulators are preparing to clarify how businesses must recognize consumer opt-out signals before personal information is disclosed through advertising technologies. With new browser requirements taking effect in 2027, businesses should reassess their consent management systems, tracking technologies, and cross-device privacy controls.
California's Next Phase of Privacy Regulation
California is taking another significant step toward strengthening consumer privacy protections, signaling that businesses must do more than simply offer consumers the ability to opt out of the sale or sharing of personal information. Businesses must ensure that those preferences are technically implemented, consistently enforced, and honored before covered disclosures occur.
At its August 6, 2026, meeting, the California Privacy Protection Agency (CalPrivacy) Board voted to direct agency staff to prepare proposed amendments addressing opt-out preference signals (OOPS), including Global Privacy Control (GPC).
The initiative reflects an important distinction in privacy compliance: providing consumers with privacy rights is not the same as ensuring that the technology supporting those rights actually works.
The anticipated regulations could affect businesses across industries, particularly those relying on website analytics, targeted advertising, customer profiling, marketing pixels, and third-party tracking technologies.
Although the proposed amendments have not yet entered formal rulemaking, the underlying obligations to recognize qualifying opt-out preference signals already exist under the California Consumer Privacy Act (CCPA) and its implementing regulations.
For businesses, the regulatory direction is clear: privacy compliance increasingly requires demonstrable technical controls rather than policies and disclosures alone.
Understanding Global Privacy Control and Existing CCPA Obligations
Global Privacy Control is a browser-based privacy mechanism that allows consumers to communicate their preference not to have their personal information sold or shared. Once GPC is enabled, the browser automatically transmits that preference to websites through a standardized technical signal.
Under the CCPA, consumers have the right to direct covered businesses not to sell their personal information or share it for cross-context behavioral advertising.
California regulations already require covered businesses to process qualifying opt-out preference signals. Importantly, businesses cannot avoid this obligation merely by providing a website privacy preference center or a "Do Not Sell or Share My Personal Information" link.
A qualifying browser signal, such as GPC, is itself a mechanism through which consumers can exercise their statutory rights.
For example, a consumer may enable GPC through a supported browser or extension and subsequently visit a retailer's website. If the retailer is subject to the applicable CCPA requirements, it must process the GPC signal in accordance with California law.
A practical challenge arises when a website simultaneously deploys technologies that transmit information to advertising networks, analytics providers, or other third parties.
Depending on the nature of the information disclosed, the recipient's permitted uses, and the contractual relationship between the parties, those disclosures may constitute a sale or sharing under the CCPA.
Consequently, a business may face regulatory exposure even when it maintains a comprehensive privacy policy and offers consumers a functional consent management interface.
Four Significant Regulatory Developments
CalPrivacy's August 2026 recommendations identify four areas for additional regulatory clarification.
- Express Recognition of Global Privacy Control
The first recommendation is to expressly identify GPC as a recognized opt-out preference signal within the CCPA regulations.
Although California regulators have long recognized GPC as a valid mechanism for communicating opt-out preferences, specifically naming the technology would remove uncertainty concerning its regulatory treatment.
This development is particularly relevant to businesses that rely on custom-built privacy management systems or third-party consent management platforms.
Businesses should evaluate whether their websites can detect qualifying signals and automatically translate those signals into enforceable privacy preferences.
A consent banner that does not recognize an incoming GPC signal may be insufficient, regardless of whether consumers can manually disable advertising cookies through the banner.
- Application of Opt-Out Rights Across Pseudonymous Profiles and Devices
The second recommendation addresses the increasingly complex relationship between consumer identity, device identifiers, and advertising technologies.
Modern advertising ecosystems frequently use identifiers that do not directly reveal an individual's name but nonetheless allow businesses to recognize, profile, and target consumers across websites, applications, and devices.
These identifiers may include browser identifiers, advertising IDs, account identifiers, and pseudonymous customer profiles.
CalPrivacy is considering additional regulatory examples clarifying how opt-out preferences apply to such profiles.
This issue has significant implications for businesses employing customer identity resolution, identity graphs, customer data platforms, and cross-device advertising technologies.
For example, a consumer may visit an online retailer using a browser configured to transmit GPC. The retailer may also maintain an account associated with that consumer and use advertising technologies that connect the account to multiple devices.
Where the business can associate the signal with a known consumer and linked personal information, existing California rules may require the opt-out to be applied more broadly than the browser session in which the signal originated.
The precise scope depends on the information the business knows and the requirements of the applicable regulations.
Therefore, businesses should not assume that an opt-out can always be confined to a single cookie, browser, or device.
The central compliance question is whether the business's advertising systems recognize a consumer more broadly than its privacy systems recognize that consumer's preferences.
Where advertising technologies link consumer identities across platforms, privacy controls must be evaluated against those same capabilities.
- Expanded Reporting of Opt-Out Preference Signal Metrics
CalPrivacy has also recommended changes to the CCPA's existing consumer request reporting requirements.
Current regulations generally require businesses that buy, receive, sell, or share the personal information of 10 million or more consumers in a calendar year to compile and disclose specified consumer request metrics.
The contemplated amendments would replace that threshold with a standard associated with processing activities presenting significant risk to consumer privacy or security.
The recommendations also contemplate reporting specific to requests received through opt-out preference signals.
If adopted, these changes could expand the population of businesses subject to reporting requirements and provide regulators with greater visibility into the effectiveness of GPC implementation.
Businesses may need to develop systems capable of distinguishing opt-out requests submitted through browser signals from those received through privacy portals or other mechanisms.
This raises practical questions about how requests are counted, how automated signals are recorded, and how organizations document their responses.
The ultimate reporting obligations will depend on the text of any regulations formally proposed and adopted.
- Timing Requirements for Website Tracking Technologies
Perhaps the most consequential recommendation concerns the timing of opt-out signal processing.
CalPrivacy has recommended adding regulatory examples addressing the relationship between GPC detection and the deployment of technologies that enable the sale or sharing of personal information.
The issue is straightforward but technically significant.
Many websites automatically load third-party scripts, advertising pixels, cookies, and tracking technologies when a visitor accesses a webpage.
In some implementations, these technologies execute before the website's consent management platform has completed processing the visitor's privacy preferences.
As a result, personal information may be transmitted to third parties before the business recognizes that the consumer has enabled GPC.
Under existing California regulations, businesses must comply with requests to opt out of sale or sharing as soon as feasibly possible, subject to the applicable regulatory requirements.
CalPrivacy's proposed clarification would reinforce that businesses cannot necessarily cure an impermissible disclosure by recognizing the opt-out after the tracking technology has already transmitted the information.
For businesses using technologies such as Meta Pixel, Google advertising tags, TikTok Pixel, or other advertising and measurement tools, the execution sequence of scripts and privacy controls deserves particular attention.
The legal analysis ultimately depends on whether the technology actually facilitates a sale or sharing of personal information. Not every cookie, analytics request, or third-party transmission automatically constitutes a prohibited disclosure.
Nevertheless, where a tracking technology facilitates activity subject to a consumer's opt-out right, businesses should ensure that the applicable restrictions are implemented before the technology transmits covered information.
Why Website Consent Management Platforms May Not Be Enough
Many organizations have implemented consent management platforms (CMPs) to address evolving privacy requirements.
These platforms can provide important functionality, including cookie banners, preference centers, consent records, and integrations with marketing technologies.
However, deploying a CMP does not automatically establish compliance.
The platform must be configured appropriately, integrated with the website's actual tracking technologies, and tested to confirm that consumer preferences are enforced.
Several common implementation issues warrant attention.
First, tag sequencing may undermine opt-out compliance. Advertising scripts may load before the CMP identifies an applicable GPC signal.
Second, website and server-side tracking may operate independently. Even where a browser-based pixel is blocked, server-side integrations or conversion APIs may continue transmitting information to advertising platforms.
Third, privacy preferences may not propagate across linked systems. A consumer's opt-out may be recognized on the website but not reflected in customer data platforms, marketing automation systems, or downstream advertising integrations.
Fourth, website changes may introduce new tracking technologies without corresponding privacy controls. Marketing teams frequently add tags through content management systems, tag managers, plugins, and advertising integrations.
These changes can undermine previously functioning privacy configurations.
Accordingly, businesses should treat CMP implementation as an ongoing compliance process rather than a one-time deployment.
Periodic technical testing, vendor oversight, and documented change management are important components of an effective privacy compliance program.
California's Enforcement History Provides Important Context
CalPrivacy's recommendations do not arise in isolation.
California regulators have repeatedly emphasized the importance of recognizing and honoring consumer opt-out signals.
The California Attorney General's 2022 Sephora enforcement action established an early and influential example of regulatory scrutiny involving GPC.
Subsequent enforcement developments have continued to focus on the practical implementation of opt-out rights, including how businesses handle advertising technologies and consumer information associated with multiple identifiers.
CalPrivacy's August 2026 presentation specifically identified enforcement developments involving Healthline, Tractor Supply, PlayOn Sports, and Disney as part of the regulatory history informing its recommendations.
These matters illustrate the importance of examining actual data flows rather than relying exclusively on the language of privacy notices.
They also demonstrate why businesses should carefully assess their relationships with advertising platforms and technology vendors.
A business may characterize a particular technology as analytics, marketing optimization, or measurement. Those descriptions do not determine whether the underlying disclosure constitutes a sale or sharing under California law.
The relevant inquiry includes what personal information is transmitted, the recipient's ability to use that information, the purpose of the disclosure, and the applicable contractual restrictions.
Regulators now have the technical capability and enforcement experience to examine those practices.
AB 566: A Significant Change Arrives January 1, 2027
The anticipated regulatory amendments coincide with another important California privacy development.
On October 8, 2025, Governor Gavin Newsom signed Assembly Bill 566, the California Opt Me Out Act.
Beginning January 1, 2027, the legislation requires covered browser developers to provide consumers with accessible, built-in functionality for communicating opt-out preferences.
This requirement is directed principally at browser developers and does not impose new opt-out obligations directly on website operators.
Nevertheless, its practical consequences for businesses could be substantial.
Historically, consumers often needed to install browser extensions, select particular browsers, or configure specialized settings to transmit GPC signals.
By requiring browser developers to offer built-in opt-out functionality, California intends to make the exercise of existing privacy rights more accessible.
Greater accessibility may result in more consumers transmitting qualifying opt-out signals when visiting websites.
For businesses, this could increase the volume of automated privacy preferences their systems must recognize and process.
Organizations should therefore evaluate not only whether their existing controls work under limited testing conditions, but also whether those controls can reliably accommodate broader consumer adoption.
Importantly, January 1, 2027, is not the initial effective date of California's obligation to honor qualifying opt-out preference signals. That obligation already exists.
AB 566 is better understood as an expansion of the mechanisms through which consumers can exercise established rights.
Implications for Businesses Operating Across Multiple States
California's regulatory developments also have implications beyond the state.
A growing number of state comprehensive privacy laws recognize universal opt-out mechanisms or impose requirements concerning automated privacy preference signals.
Although the scope, implementation deadlines, and technical requirements vary by jurisdiction, businesses operating nationally face evolving and overlapping obligations.
A company that uses one centralized website, advertising platform, or consent management system may need to account for different state privacy requirements within the same technical environment.
Businesses should therefore consider whether their privacy architecture can accommodate applicable state-specific requirements without creating inconsistent or conflicting consumer experiences.
For some organizations, adopting a consistent technical approach to recognizing qualifying opt-out signals may reduce operational complexity.
However, a uniform approach should be evaluated against the organization's business model, legal obligations, and applicable jurisdictional requirements.
California's proposals may also influence broader regulatory expectations regarding the relationship between identity resolution technologies and consumer privacy rights.
Practical Compliance Steps Businesses Should Consider Now
Businesses need not wait for final regulations to begin assessing their exposure.
The following measures can help organizations identify and address potential weaknesses in their current privacy programs.
- Conduct a comprehensive website tracking assessment.
Identify advertising pixels, analytics scripts, cookies, software development kits, tag management systems, and server-side tracking integrations.
Determine what information each technology collects, when it executes, and where the information is transmitted.
- Test Global Privacy Control functionality.
Use supported browsers or testing environments to determine whether the website detects qualifying GPC signals.
Confirm that the appropriate privacy preferences are applied automatically, without requiring action from the consumer.
- Evaluate the timing of tracking technologies.
Review whether technologies that facilitate the sale or sharing of personal information execute before the applicable opt-out controls become effective.
Testing should include initial page loads, navigation between pages, and relevant changes in consumer authentication status.
- Review server-side integrations.
Evaluate conversion APIs, customer data platforms, and other backend integrations to ensure that applicable opt-out preferences are communicated and enforced.
Blocking a browser-based pixel may not be sufficient if equivalent personal information continues to be transmitted through another channel.
- Assess cross-device and account-level privacy controls.
Determine whether the organization associates browser identifiers with customer accounts, advertising identifiers, or other persistent profiles.
Review how opt-out preferences are applied to personal information associated with those identities.
- Review CMP configuration and vendor agreements.
Confirm that the organization's consent management platform supports applicable opt-out signal requirements and that relevant integrations are configured correctly.
Review agreements with advertising and analytics vendors to understand permitted data uses, contractual restrictions, and responsibilities for honoring privacy preferences.
- Maintain documentation of compliance testing.
Retain records of relevant technical assessments, identified deficiencies, remediation efforts, and subsequent validation.
Such documentation may assist businesses in demonstrating the operation of their privacy controls during regulatory inquiries.
- Establish ongoing governance and monitoring.
Assign responsibility for reviewing new website technologies, changes to advertising integrations, and modifications to consent management configurations.
Privacy compliance should be integrated into marketing technology procurement, website development, and vendor management processes.
The Broader Implications: Privacy Compliance Is Becoming a Technical Accountability Issue
California's anticipated regulations reflect a broader evolution in privacy enforcement.
Historically, organizations often concentrated their privacy compliance efforts on drafting policies, establishing consumer request procedures, and implementing consent interfaces.
Those measures remain important, but regulators are now examining whether the underlying systems operate consistently with the rights described in those documents.
The growing use of automated advertising, identity resolution, server-side tracking, and interconnected marketing platforms makes this inquiry more complex.
It also increases the importance of collaboration among legal, IT, cybersecurity, marketing, and compliance teams.
Legal counsel may determine the organization's obligations under the CCPA, but technical personnel must understand how those obligations translate into website configuration, data flows, and vendor integrations.
Neither function can operate effectively in isolation.
For businesses, the emerging compliance standard is not simply whether consumers can communicate their privacy preferences.
It is whether the organization can demonstrate that those preferences meaningfully control the processing and disclosure of personal information.
Looking Ahead
CalPrivacy's August 2026 action represents an important step toward additional regulatory clarification, but it does not itself establish final new requirements.
CalPrivacy must still develop proposed regulatory text and complete the applicable rulemaking process before amendments become effective.
Nevertheless, businesses should recognize that many of the underlying concerns already arise under existing California law.
With AB 566 taking effect in January 2027, consumer use of automated opt-out signals may become more common.
Organizations that rely on website tracking, behavioral advertising, and cross-device customer identification should use this period to examine their technical infrastructure and identify potential compliance gaps.
The central lesson is that honoring consumer privacy preferences requires more than recognizing a signal. Businesses must ensure that the signal actually governs the relevant data practices, at the appropriate time, across the systems where those practices occur.
As California continues to strengthen its privacy enforcement framework, organizations that invest in meaningful technical controls, comprehensive testing, and documented privacy governance will be better positioned to manage evolving regulatory expectations.
Shumaker's Technology, Data Privacy, Cybersecurity & Artificial Intelligence Service Line advises businesses on compliance with evolving privacy requirements, website tracking technologies, consent management programs, regulatory investigations, and data governance. Businesses seeking assistance evaluating their CCPA compliance programs, Global Privacy Control implementation, or advertising technology practices should consult experienced privacy counsel.
This article is provided for informational purposes only and does not constitute legal advice.
If you have any questions or to learn more, please contact a member of Shumaker’s Technology, Data Privacy, Cybersecurity & AI Service Line.