Privacy ComplianceOpt-Out Signals
California Proposes New Global Privacy Control Rules. What Would Change?
California's privacy regulations describe opt-out preference signals only in general terms today. CalPrivacy, the state's privacy agency, has drafted rules that would specifically name the Global Privacy Control and make clear that websites already have to check for it before loading tools that sell or share personal information. They would also require more businesses to publish opt-out metrics. The agency's board will vote on November 6 on whether to begin the formal rulemaking process.
By Alex Proctor
Published October 28, 2026
Summary
CalPrivacy's draft would specifically name the Global Privacy Control (GPC) in California's regulations and add examples on timing, cookie syncing, and linked devices. The agency describes most of the changes as clarifications, so in its view websites already have to check for the signal before loading tools that sell or share personal information. The main new requirement is that more businesses would have to publish how many of their opt-out requests arrive through signals such as the GPC. I recommend that businesses confirm how their websites handle the signal now, before the rules are final.
What Is CalPrivacy's Board Voting On?
On November 6, 2026, CalPrivacy's board will consider whether to begin a formal rulemaking on opt-out preference signals. Staff have recommended advancing the draft and opening a 45-day public comment period. The board started preliminary work on the topic in November 2025 and heard staff's findings in August 2026.
Staff also prepared an initial statement of reasons that explains each change. According to that statement, the amendments "generally do not create new obligations" and instead "provide additional guidance to businesses regarding what is already required."
What Would the Proposed Rules Change?
Most of the changes add examples to the existing sections on opt-out preference signals (Section 7025) and opt-out requests (Section 7026). The table lists the main changes by topic:
| Topic | What the Draft Says | Section |
|---|---|---|
| Naming the GPC | Names the Global Privacy Control as an example of a valid signal that businesses must honor | 7025(b)(1) |
| Cookie syncing | Businesses must stop third parties on their sites from syncing user IDs for advertising | 7025(c)(7)(F) |
| Linked devices | Businesses that link a person's devices for advertising must apply the opt-out to all of them | 7025(c)(7)(G) |
| Browser features | Browser features that act for consumers and share their information must still send the signal | 7025(h) |
| Timing | Websites must check for the signal before loading cookies or pixels that sell or share data | 7026(f)(3)(C) |
| Metrics | More businesses would publish request metrics, including opt-outs received through signals | 7102(a) |
Based on CalPrivacy's proposed text for the November 6, 2026 board meeting.
Businesses already have to honor the signal under California's regulations. However, those regulations describe signals only in general terms, with "an HTTP header field or JavaScript object" as the example format. The draft would specifically name the Global Privacy Control. The statement of reasons says that the GPC has become "the most widely supported opt-out mechanism across consumers, states, and browsers" over the past five years.
Why Does the Timing Example Matter?
The draft adds an example of an online retailer that uses a consent management platform and a tag management system. Its website sets "third-party advertising and analytics cookies and pixels that facilitate the sale or sharing of personal information" before those systems determine whether the visitor sent the GPC. The draft concludes that the retailer has not honored the opt-out "as soon as feasibly possible," which the existing timing rule requires.
The GPC is sent with the browser's first request for a page, so websites receive it before any script runs. According to the statement of reasons, it is "entirely feasible" to detect the signal before loading tools that sell or share personal information. The statement calls loading those tools first "a direct violation of the timing requirement."
The example is limited to tools that sell or share personal information, such as advertising pixels. It does not require every tag to wait for visitors' choices on a consent banner. Websites that use an opt-out model may still load advertising tools by default for visitors who have not sent the signal, provided the check runs first.
For visitors in regions that use an opt-out model, tags often fire within moments of the page loading, potentially before consent platforms have had time to read the signal and pass it on. In practice, the signal check may need to happen in the tag manager or in the tags themselves.
What About Cookie Syncing and Linked Devices?
Cookie syncing is the practice of advertising companies matching their user IDs to recognize the same consumer across browsers or devices. The draft says that businesses receiving the signal must prevent third-party tracking technologies on their websites "from initiating or performing cookie syncing for cross-context behavioral purposes." At the board's August meeting, Northeastern University professor Christo Wilson explained that cookie syncing "happens automatically as soon as the third parties start to load." By then the IDs have already been shared, so the signal has to be checked before those third parties load.
Two more examples apply the existing rule on pseudonymous profiles, which track a person by device or ID rather than by name. A retailer that uses fingerprinting to link a consumer's laptop and phone must apply an opt-out sent from the laptop to the phone too. A retailer that keeps each device separate does not have to start linking them.
The statement of reasons says that these examples were informed by the California Attorney General's settlement with Disney in February 2026. It quotes the complaint, which says that "if a business can associate a consumer's devices with the consumer for advertising purposes, it can and must associate those devices with the consumer for purposes of honoring the consumer's opt-out rights."
What Would Change for Browsers?
Under the draft, if a browser has a feature that "interacts with a business on the consumer's behalf" and makes personal information available to that business, the feature must not prevent the consumer's opt-out signal from being sent. For browser developers, the rule would work alongside the California Opt Me Out Act, which requires browsers to offer a setting for the signal starting January 1, 2027.
The statement of reasons notes that modern browsers "increasingly offer features and tools that actively retrieve information on behalf of the consumer." This likely includes AI assistants built into browsers, which can visit websites and complete tasks for users.
Which Businesses Would Publish Opt-Out Metrics?
Today, only businesses that buy, receive, sell, or share the personal information of 10 million or more consumers a year must publish yearly metrics on privacy requests. The draft would extend this to businesses that must complete a cybersecurity audit or a risk assessment. It would also require a separate count of opt-outs received through signals such as the GPC.
Under the current regulations, cybersecurity audits apply to businesses that earn half or more of their revenue from selling or sharing personal information, or that have more than $26.6 million in annual revenue and process large amounts of personal information. Risk assessments reach further, covering any business that sells or shares personal information or processes sensitive personal information.
The change would likely reach many businesses whose websites share data with advertising partners. The agency's draft notice estimates that the rules would apply to about 53,800 businesses.
What Happens Next?
If the board approves the draft, the agency will publish a notice, accept comments for 45 days, and hold a public hearing. It can revise the text before the final rules go to California's Office of Administrative Law.
Because the agency treats the timing and linked device examples as clarifications, the rules they explain already apply. I recommend that businesses confirm whether their websites check for the signal before any tool that sells or shares personal information runs, including third parties that sync cookies. Businesses newly covered by the metrics requirement should also confirm that their records can count opt-outs received through signals separately.
Questions
Are California's proposed GPC rules in effect yet?+
No. If the board votes to proceed on November 6, the draft goes out for a 45-day public comment period before the agency finalizes it. However, the timing and linked device rules that the new examples explain are already in effect.
Under the draft, does every tag have to wait for the consent banner?+
No. The timing example covers tools that sell or share personal information. It requires websites to check for the GPC, which arrives with the browser's first request, before those tools run. Tools that do not sell or share personal information are outside the example.
Does the draft require websites to honor signals other than the GPC?+
Yes. The draft names the GPC as an example, but businesses that sell or share personal information must honor any signal that meets the requirements of Section 7025(b). The signal has to be in a format that businesses commonly use and recognize. The tool that sends it also has to make clear to consumers that it is meant to opt them out of the sale and sharing of their personal information.
Briefings are informational and do not constitute legal advice.
Ready for the regulators?
I'll check your website for privacy law compliance.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.