CPPA staff propose naming Global Privacy Control in CCPA opt-out signal rules and widening metrics reporting
The draft would also bar certain browser features from blocking opt-out signals and extend annual metrics reporting to businesses subject to cybersecurity audits or risk assessments. The Board was due to consider it on 5–6 November.
Staff at the California Privacy Protection Agency (CPPA) have prepared draft amendments to the CCPA regulations on opt-out preference signals. The draft names Global Privacy Control (GPC) as an example of a commonly recognised signal that businesses selling or sharing personal information must honour. It also states that browser features acting for consumers that make personal information available must not “prevent, interfere with, contradict, or disable” the signal.
Annual metrics reporting, now limited to businesses handling data on 10,000,000 or more consumers, would extend to any business required to complete a cybersecurity audit or risk assessment. Covered businesses would also report opt-out requests received through a signal separately. According to Inside Privacy, the Agency cites enforcement experience showing many businesses fail to detect or honour signals.
Staff recommend that the Board start formal rulemaking with a 45-day comment period. Hearing dates have not yet been set.
Why it matters
Privacy teams should confirm that GPC signals are detected on their sites and apps and flow through to sale and sharing opt-outs in downstream systems, not just cookie banners. Businesses already within scope of the cybersecurity audit or risk assessment rules should check whether they can log and count opt-out requests by channel, since signal-based requests would need separate reporting. The Opt Me Out Act, which requires browser developers to offer GPC functionality, is set to take effect on 1 January 2027.
Status: Proposal. Staff draft; Board must vote to open formal rulemaking
Key dates
- CPPA Board meeting (5–6 November) due to consider opening formal rulemaking on the draft
- Opt Me Out Act takes effect, requiring browser developers to offer GPC functionality
Sources
Was this useful?
Thanks. What was the problem?
Thank you — this helps us choose what to cover. If you spotted an error, please tell us what it is.
Prepared with AI assistance and reviewed by the editor before publication. Spotted an error? Tell us — see our editorial policy and methodology.
Governance areas
Institutions
Who should care
- DPO
- Legal & compliance
- Privacy engineering
- Data stewards