CalPrivacy Board Votes 5-0 to Open Formal Rulemaking on Opt-Out Preference Signals

California’s privacy regulator has moved its opt-out preference signal package from draft to formal rulemaking. On November 6, 2026, the five-member board of the California Privacy Protection Agency, which now brands itself CalPrivacy, voted 5-0 to send proposed amendments to the CCPA regulations out for public comment. The package names Global Privacy Control in the rule text, adds worked examples on cookie syncing, cross-device fingerprinting and browser features that act for consumers, and widens who has to publish request metrics. The same meeting also previewed what the agency wants from the Legislature in 2027 and where its next two rulemakings on consumer friction and privacy notices are heading.

What the board actually approved

The vote was on agenda item 9 of the November 5–6 meeting in San Francisco. A staff memo dated November 6 and signed by Senior Privacy Counsel Lisa Kim, General Counsel Philip Laird and three colleagues asked the board to advance the draft to formal rulemaking, open the 45-day comment period, and let staff make “non-substantive or clarifying revisions” needed to reflect the board’s direction and the state’s Administrative Procedure Act. The board granted that. Trade press covering the meeting reported that staff would look again at wording suggested by Chair Jennifer Urban and board member Alastair Mactaggart in the pseudonymous-profile examples before the package is published.

This is the third step in a process that started a year earlier. At its November 7, 2025 meeting the board directed staff to begin preliminary work on opt-out preference signals, or OOPS. Staff gathered written comments, reviewed enforcement experience and looked at other states with universal opt-out laws, then reported back at the August 6–7, 2026 meeting, where the board told staff to prepare a formal package. The proposed text itself is dated October 8, 2026.

We covered that draft text when it first appeared in our piece on the CalPrivacy draft OOPS rules naming Global Privacy Control, including the logged-in and logged-out consumer examples. This article focuses on what the vote changes, the provisions that got less attention, and what else the board discussed.

The provisions most likely to change engineering work

Staff describe most of the package as clarification of duties that already exist. That is accurate as a legal matter, since California has required businesses that sell or share personal information to honor browser signals since the 2023 regulations. In practice, several examples spell out expectations that many websites do not meet today.

• Cookie syncing. A new example in section 7025 describes a site that lets third-party tags match their user IDs with each other to build a richer ad profile. When that site receives a signal, it must stop those third parties from starting or performing cookie syncing for cross-context behavioral advertising, which means configuring the site so the partner code cannot sync at all once the signal is present.
• Pseudonymous, cross-device profiles. Another example describes a retailer that uses matching techniques such as digital fingerprinting to tie a shopper’s laptop and phone into one profile without a name or login. If the shopper turns on GPC on the laptop, the business has to stop selling and sharing data tied to every device linked to that pseudonymous profile, not just the laptop. A contrasting example says a business that keeps data in unlinked, device-specific form only has to apply the signal to that device.
• Tag timing. In section 7026, a new example describes an online retailer whose advertising and analytics cookies and pixels fire before its consent management platform and tag manager check for the GPC signal. The draft says the signal is received with the browser’s first request, so letting those tags run first means the business has not complied “as soon as feasibly possible.”
• Browser features that act for the consumer. A new subsection (h) says that if a browser, as defined in Civil Code section 1798.136, has a feature, tool or function that interacts with a business on the consumer’s behalf and makes the consumer’s personal information available, that feature must not block, interfere with, contradict or disable the opt-out signal from reaching the business. Assistant-style and agent features built into browsers are the obvious target.

The browser provision connects to the California Opt Me Out Act, the agency-sponsored bill signed in October 2025 that requires browser developers to offer a built-in opt-out setting. Agency slides at the same meeting list January 1, 2027 as the date that law takes effect. Once browsers ship the setting by default, far more requests will arrive as signals, and the regulations make clear those signals have to survive any browser feature sitting between the consumer and the site.

Metrics reporting reaches more companies

The provision with the clearest new cost is in section 7102. Today, the metrics duty applies to businesses that know or reasonably should know they handle the personal information of 10 million or more consumers in a calendar year. The proposal adds any business that must complete a cybersecurity audit under section 7120 or a risk assessment under section 7150. Every business subject to the metrics rule would also have to say how many of its opt-out requests arrived through a preference signal.

The agency’s initial statement of reasons estimates the cost at about half an hour of staff time, or roughly $31.47 per business at its blended wage rate, on the theory that companies already track the underlying numbers. Companies whose signal handling is patchy may find the harder problem is producing a count they are willing to publish. A small signal-request figure next to large web traffic is the kind of number a regulator or plaintiff will notice. Businesses already preparing for the state’s new privacy risk assessment rules should add the signal count to the same evidence file.

What happens next, step by step

1. Notice publication. The package goes to the California Regulatory Notice Register. The draft notice still shows “[date]” placeholders, so the comment deadline and hearing date are not set yet.
2. Written comments. The draft notice directs comments to regulations@cppa.ca.gov with the subject line “Public Comment on Opt-out Preference Signals (OOPS) Regulations,” or by mail to the agency’s Legal Division, by 5:00 p.m. Pacific on the closing date.
3. Public hearing. The agency will hold a hearing, with remote access, where anyone may give oral or written testimony.
4. Staff review. General Counsel Laird told the board that staff will review comments and come back either to ask for adoption or to propose changes, which would trigger another, shorter comment round.
5. Adoption and approval. Only after board adoption and review by the Office of Administrative Law would the amendments take effect.

The rest of the agenda: 2027 bills and two new rulemakings

Deputy Director of Policy and Legislation Maureen Mahoney summarized the 2026 legislative session: more than 75 privacy, technology and AI bills introduced, more than 45 signed and five vetoed. The agency-sponsored SB 923, the Expanding Privacy Rights Act, was signed. AB 1542 on sensitive personal information, which the agency supported, was vetoed.

For 2027, staff recommended that the agency consider sponsoring a CCPA amendment banning facial recognition and the collection of biometric data by consumer wearable recording devices, with exceptions for assistive technologies. In a second tier, staff suggested research and possible support for bills requiring opt-in consent before personal information is used to train AI models, limits on automated license plate readers, easier reset and deletion of mobile and connected-TV advertising IDs, and notice and affirmative consent before smart TVs use automated content recognition on viewing data. These are staff recommendations for the agency’s positions. None of them is a bill yet.

The board also heard preliminary findings in two other proceedings. On reducing friction in the exercise of privacy rights, staff proposed an agency-built tool to help consumers send one request covering all their CCPA rights, a business template, rules requiring sites that use cookie banners for opt-outs to explain how cookie settings relate to the sale and sharing opt-out, and a definition of when a consumer “intentionally interacts” with a third party. On notices and disclosures, staff proposed a short summary at the top of privacy policies, a definite past-tense statement on whether the business sold or shared data in the last 12 months, a rule that vague retention language like “as long as necessary” is not enough, and a requirement to publish prior versions of the privacy policy. Both are at the preliminary stage, with no proposed text adopted.

Frequently asked questions

Does the vote change what businesses must do today?

Not legally. The amendments are proposed. But the existing regulations already require businesses that sell or share data to honor opt-out signals, and California has brought enforcement cases over GPC handling, so the examples are best read as a statement of how the agency already reads the rules.

Is Global Privacy Control the only signal that counts?

No. The text lists GPC as an example of a signal in a commonly used format, alongside an HTTP header field or JavaScript object. Any signal meeting the regulation’s requirements must be processed.

We only use first-party analytics. Does the cookie-syncing example matter to us?

It matters if any tag on your site shares data with third parties for cross-context behavioral advertising. A tag audit is the fastest way to find out whether partners are syncing IDs on your pages.

When will the comment window close?

The date will be set when the notice is published. The written period runs 45 days, and any later changes would usually get a 15-day round.

The signal is now the main path to opt out

For five years, many companies treated opt-out signals as an edge case next to the “Do Not Sell or Share” link. This package, together with browser-level signals arriving in 2027, makes the signal the main way most Californians will opt out. The businesses that do well under the final rule will be the ones that can show, with logs and a published number, that the signal reached every tag, profile and partner it was supposed to reach. Read the proposed regulation text and the staff memo to the board before the comment clock starts.