California Proposes Updated Privacy Rules for Consumer Opt-Out Signals
The California Privacy Protection Agency (CPPA) has released proposed regulatory amendments that would clarify how businesses must process consumer requests to opt out of the sale or sharing of personal information. The changes would strengthen requirements for recognizing automated privacy signals, managing consumer data, and responding to opt-out requests under the California Consumer Privacy Act (CCPA).
The proposed regulatory text, dated Oct. 8, 2026, addresses opt-out preference signals (OOPS), including Global Privacy Control (GPC), which allows consumers to communicate their privacy preferences automatically through their browsers or devices.
The proposal is scheduled for discussion at the CPPA’s Nov. 5-6 board meeting. The provisions have not been adopted.
Proposed Changes to Consumer Privacy Requirements
Under the proposal, businesses subject to the applicable CCPA requirements would need to honor qualifying opt-out preference signals and apply those requests to personal information associated with a consumer’s browser, device, and linked consumer profiles.
Key provisions include:
- Recognizing Global Privacy Control: The regulations would explicitly identify GPC as an example of a valid opt-out preference signal.
- Expanding opt-out coverage: Businesses would need to apply signals to associated consumer profiles, including pseudonymous profiles that connect activity across multiple devices.
- Preventing unauthorized data sharing: Businesses would need to configure tracking technologies to prevent prohibited sharing of personal information after receiving an applicable signal.
- Confirming consumer requests: Businesses would be required to provide a way for consumers to verify that their opt-out requests have been processed.
- Strengthening response procedures: Businesses would need to stop selling or sharing affected information as soon as feasible, within a maximum of 15 business days, and notify certain third parties when applicable.
The proposal also clarifies that businesses cannot require consumers to provide unnecessary additional information before processing an automated opt-out request.
Implications for Debt Collection and Receivables Management
For debt collectors, debt buyers and other receivables management businesses subject to the CCPA, the proposed amendments could require additional attention to website tracking technologies, consumer information systems and third-party data-sharing arrangements.
Organizations that use advertising pixels, cookies, or other technologies capable of sharing personal information for cross-context behavioral advertising may need to evaluate whether those systems recognize and honor automated privacy signals.
Businesses should also assess how privacy preferences are maintained across consumer profiles and connected devices.
The proposed opt-out provisions concern the sale and sharing of personal information under California privacy law. They do not automatically prohibit legitimate collection activities or all disclosures to contracted service providers.
California Continues Privacy Rulemaking
The changes follow California’s adoption of the Opt Me Out Act, which requires web browsers to offer built-in opt-out preference signals beginning Jan. 1, 2027.
The proposed amendments also address cybersecurity audit procedures, privacy metrics reporting, risk assessments, and certain automated decision-making technology requirements.
The CPPA has not yet adopted the amendments or established an effective date for the proposed changes. Businesses can follow the agency’s opt-out preference signal rulemaking updates as the proposal moves forward.
