Proposed Rules Clarify Browser Opt-Outs for CA Ad Firms

Advertisers and data-sharing businesses in California will need to honor browser-based opt-out signals such as the Global Privacy Control.

Updated on Nov. 4, 2026 in Advertising

Proposed Rules Clarify Browser Opt-Outs for CA Ad Firms

Live Poll

Do you trust companies to honor your online privacy opt-out choices?

California Privacy Protection Agency staff released proposed amendments to CCPA opt-out preference signal regulations, including explicit recognition of the Global Privacy Control. The CPPA Board will consider advancing the package to formal rulemaking at its November 5-6 meeting, affecting businesses that process consumer opt-outs in California.

Why it matters

Enforcement actions since 2020 have shown that many businesses fail to detect, honor, or properly implement opt-out preference signals, and the proposal is meant to reduce that confusion about compliance obligations. For California businesses that sell or share consumer data, the rules define what a valid opt-out signal looks like before the state's browser-level requirement arrives.

Staff reviewed 376 pages of public comments before releasing the proposal, which carries a 45-day public comment period and a 15-day period for sufficiently related modifications. The proposal would extend annual metrics reporting, which currently applies only to businesses handling personal information of 10,000,000 or more consumers, to any business required to complete a cybersecurity audit or risk assessment.

The players

California Privacy Protection Agency

The state agency that enforces the California Consumer Privacy Act, issuing rules and enforcement actions that govern how businesses collect, sell, and share consumer data.

Global Privacy Control

A browser-based opt-out signal standard that lets consumers tell websites not to sell or share their personal data, now explicitly recognized in California's proposed rules.

The details

The proposal expressly identifies the Global Privacy Control as an example of a valid opt-out signal and adds illustrative examples on when a business must process an opt-out preference signal as a valid sale or share opt-out. It also requires that browser features interacting with businesses on a consumer's behalf not prevent, interfere with, contradict, or disable the consumer's opt-out preference signal from being sent. The proposal further adds a "to the best of my knowledge" qualifier to the cybersecurity audit attestation.

November 7, 2025: The Board directed staff to conduct preliminary rulemaking on opt-out preference signals.
August 6-7, 2026: Staff presented findings, and the Board instructed preparation of formal rulemaking materials.
November 5-6, 2026: The Board will consider advancing the proposed package to formal rulemaking.
January 1, 2027: The Opt Me Out Act's requirement that browser developers offer Global Privacy Control functionality takes effect.

Market Landscape

The proposal builds on the CCPA's existing opt-out framework, which enforcement actions since 2020 have shown many businesses have struggled to implement correctly. It follows the Opt Me Out Act, which requires browser developers to offer Global Privacy Control functionality beginning January 1, 2027.

Businesses that sell or share consumer data in California should review how they detect and honor opt-out preference signals, including the Global Privacy Control, before the rules are finalized. Ad-tech and marketing teams should also confirm whether they fall under the expanded metrics-reporting obligations tied to cybersecurity audits and risk assessments.

The takeaway

Treat opt-out signal handling as an operational compliance function rather than a legal afterthought, and map which of your systems detect and honor browser-based signals. Track the November 5-6, 2026 CPPA Board meeting agenda, since its outcome determines when these standards become formal rules.

What happens next

The CPPA Board will consider advancing the proposed package to formal rulemaking at its November 5-6, 2026 meeting, and the Opt Me Out Act's browser requirement takes effect January 1, 2027.