California’s privacy regulator has published draft text that would name Global Privacy Control in its own rules as an example of an opt-out preference signal businesses must honor. The proposed amendments to the opt-out preference signal regulations, which the agency calls “OOPS,” are on the agenda for the California Privacy Protection Agency board meeting on November 5 and 6, 2026, where the board may vote to start formal rulemaking.
For most companies that sell or share personal information, the draft does not create a brand new duty. California has required businesses to treat browser-based opt-out signals as valid requests since the 2023 regulations took effect, and enforcement actions have already turned on whether websites actually processed GPC. What the new text does is remove room for argument. It names GPC by name, adds worked examples that show how the agency expects signals to apply to browsers, devices, accounts and offline data, and adds a requirement that the business show on its website whether it processed the signal.
What the draft text actually says
The proposed text, dated October 8, 2026 and posted with the November board materials, amends Section 7025 of the CCPA regulations and related sections. A few provisions matter most for day-to-day operations.
- The signal format. A signal must be in a format commonly used and recognized by businesses. The draft gives as its example “an HTTP header field, like Global Privacy Control (GPC), or JavaScript object.”
- Scope of the opt-out. A business must treat a valid signal as an opt-out of sale and sharing for that browser or device and any consumer profile associated with it, including pseudonymous profiles. If the business knows who the consumer is, the opt-out must also apply to the consumer.
- No extra hoops. A business cannot require more information than is needed to send the signal. It may offer the consumer a chance to identify themselves so the opt-out can reach offline sales, but if the consumer ignores that offer, the signal still has to be honored for the browser or device.
- Conflicts with settings. If the signal conflicts with a business-specific privacy setting that allows sale or sharing, the signal wins. The business may notify the consumer of the conflict and ask for consent, following the consent rules in Section 7004.
- Absence is not consent. Where the consumer is known, a business cannot read a missing signal on a later visit as permission to resume selling or sharing.
- Visible status. The business must display on its website whether it processed the signal as a valid opt-out. The draft’s example is a message such as “Opt-Out Request Honored,” together with a toggle or radio button showing that the consumer is opted out.
The draft then walks through scenarios with named hypothetical consumers. One visits a site with a signal enabled while logged out, so the business has to stop selling or sharing data tied to the browser identifier but cannot extend the opt-out to an account it cannot connect. Another is logged in, so the opt-out has to reach her account and offline sales too, and the business must wait at least 12 months before asking her to opt back in.
Why naming GPC matters even though the duty already existed
Businesses have had several excuses for patchy signal handling. Some argued that it was unclear which signals counted. Others processed GPC for cookies set by their own tags but not for server-side data flows, logged-in accounts, or data passed to partners through APIs. The worked examples close several of those gaps in writing. If the board adopts something close to this text, a company will struggle to argue that it did not understand the agency’s expectations.
Regulators in other states have been moving the same way. Our earlier coverage of Colorado’s GPC sweep and the end of its cure period showed that signal handling has become one of the easiest things for an enforcer to test from the outside. California’s own Opt Me Out Act pushes the browser side as well, by requiring browsers to offer a built-in opt-out setting. More signals will reach websites, and the draft makes clear what happens when they arrive.
Five things to check before the November board meeting
The text is a draft and can change. Even so, nothing in it conflicts with what California already requires, so the work below is worth doing now.
- Confirm your site reads the signal at all. Open your site in a browser with GPC enabled and check whether your consent tool or tag manager detects the Sec-GPC header or the navigator.globalPrivacyControl property. Our guide to GPC signal handling covers the common failure points, and our walkthrough on running a cookie audit with GPC testing explains how to document the test.
- Check what actually stops. A banner that changes color is not proof that tracking stopped. Capture network traffic with the signal on and confirm that advertising pixels, data-sharing tags and server-side events tied to sale or sharing no longer fire or are flagged as opted out.
- Follow the signal to accounts and offline data. If a logged-in user sends GPC, does the opt-out flag reach your CRM, your customer data platform and any partner feeds? The draft’s logged-in examples assume it does.
- Add a visible status. Plan where the “opt-out honored” message or toggle will appear, and make sure it reflects the real state of the consumer’s choice rather than a cosmetic label.
- Review your re-consent prompts. If you ask signal users to opt back in, check that the prompt meets the Section 7004 consent rules and that you are not asking again sooner than the 12-month waiting period the examples describe.
How a signal should flow through your systems
It helps to think about the signal as data that has to travel. It arrives in an HTTP request. Your consent layer has to read it and record an opt-out state. That state has to reach every tag that sells or shares data, every server-side integration that sends events to advertising platforms, and every system that holds a profile linked to the browser or account. If any one of those systems keeps its own default, the opt-out leaks.
Retention matters too. The draft says information a consumer provides to help process an opt-out cannot be used for anything else. If your consent tool asks for an email address to extend the opt-out offline, that address should not drop into a marketing list.
The broader idea behind the rule, a universal opt-out mechanism, only works when businesses treat the signal as a request rather than a preference. That is the shift the draft is trying to lock in.
Where Captain Compliance fits
Captain Compliance’s consent management platform sets up cookie consent banners and preference handling, and its Radar scan checks a URL for GPC signals, dark patterns and other issues regulators are enforcing. Its cookie scanner produces a cookie inventory you can compare against what fires when a signal is present. These tools help you find and document gaps. They do not by themselves make a business compliant, and the signal still has to be carried into back-end systems that sit outside any website tool.
Readers who want to test their own browsers first may find our piece on which ad blockers send the GPC signal useful, since it explains why some consumers send the signal without knowing it.
Frequently asked questions
Is the new GPC language already in force?
No. It is proposed text. The board is expected to discuss it on November 5 and 6, 2026 and may vote to begin formal rulemaking, which includes a public comment period. The existing requirement to honor opt-out preference signals is already in force.
Does this apply if my company does not sell or share personal information?
The duty to process signals as opt-outs of sale and sharing applies to businesses that sell or share personal information. A business that does neither still needs to be sure that is true, including for advertising pixels that may count as sharing for cross-context behavioral advertising.
Can we ask GPC users to opt back in?
Under the draft, a business may tell the consumer about a conflict with their settings and ask for consent, but it must process the opt-out first and follow the consent rules. The examples describe waiting at least 12 months before asking a consumer to opt in again.
What does “display the status” mean in practice?
The draft’s example is a message such as “Opt-Out Request Honored” plus a toggle or radio button showing the consumer is opted out. The point is that the consumer can see that the business received and processed the signal.
Does a logged-out visitor’s signal apply to their account?
Only if the business can connect the browser to the account. The draft’s first example says that when the business cannot make that link, the opt-out applies to the browser identifier but not to the account.
The test is about to get easier to run
Anyone can turn on GPC and watch what a website does. That has always made signal handling an easy target for regulators and plaintiffs. Once the agency writes its expectations into worked examples, the gap between what a site claims and what its network traffic shows will be even simpler to prove. The board meeting will decide the timing. Companies still deciding whether to fix their signal handling have a few weeks left before the question is put in front of them on the agency’s terms.
