Proposed CCPA regulations advanced by CalPrivacy

On November 6, 2026, the California Privacy Protection Agency (CalPrivacy) Board heard its staff’s recommendations regarding amendments to the California Consumer Privacy Act (CCPA) regulations primarily related to opt-out preference signals (OOPS).

The proposed amendments would expressly recognize the Global Privacy Control (GPC) as an opt-out preference signal, prohibit browser features that interfere with OOPS, extend identity verification for rights requests to automated decision-making technology (ADMT) appeals, expand business obligations for reporting rights request metrics, add illustrative examples fleshing out OOPS applicability, and make minor but important changes to the cyber audit and risk assessment certifications.

The CalPrivacy Board voted to advance the amendments to formal rulemaking, a process that is likely to begin in the coming weeks, putting the amendments on a timeline to be in effect by mid-2027. Below, we provide a summary of the changes in the amendments, which could have significant implications for companies engaged in digital advertising.

Amendment summary

The GPC is expressly acknowledged. The amendments identify the GPC as an example of an opt-out preference signal that regulated businesses will have to acknowledge.

Additional examples aim to cut down on perceived OOPS gaps. The amendments add three examples regarding how businesses must comply with OOPS:

1. An OOPS halts cookie syncing. If a business allows third parties to place cookies on its website to track consumers’ browsing activity across various sites and applications – a practice known as cookie syncing – the business must stop cookie syncing if the business receives an OOPS.
2. OOPS obligations apply to pseudonymous profiles. If a business “uses matching technologies, like fingerprinting, to link [a consumer’s various] devices and create a pseudonymous profile” of the consumer, the business cannot sell or share personal information associated with the pseudonymous profile if the consumer enables an OOPS on any of the consumer’s devices linked to the known profile.

   This example received the most interest from the CalPrivacy Board during its meeting. The Board requested that the staff verify whether businesses can link devices without creating a pseudonymous profile, signaling the Board’s interest in future-proofing the regulations. The Board took particular interest in the phrasing “to link [a consumer’s various] devices and create a pseudonymous profile,” noting that the regulations should remain applicable to a business that does not need to create a profile to track a consumer across linked devices.

3. Maintaining consumer information in unlinked, device-specific form can limit the extension of an OOPS. In one of the new, proposed examples, if a business maintains consumer information in a device-specific form that does not recognize or link the consumer across devices or browsers, the consumer’s use of an OOPS on a device and browser does not extend the business’s OOPS recognition obligation to other, unlinked devices or browsers.
4. Cookie and tag management tools cannot preempt an OOPS. A business that uses a consent management platform (CMP) or tag management platform (TMS) must configure its website to determine whether it has received a GPC signal before allowing a CMP or TMS to set third-party advertising and analytics tracking technologies

Browser features cannot interfere with an OOPS. If a browser feature or tool interacts with a business on a consumer’s behalf and makes the consumer’s personal information available to the business, the feature cannot interfere with the consumer’s OOPS.

Identity verification for rights requests extends to ADMT appeals. In addition to existing rights request verification methodologies, businesses must now have a reasonable method of verifying the identity of consumers who request to appeal a significant decision made by ADMT.

Expanded metric reporting obligations. The proposed amendments would expand the obligation to report privacy right request metrics to any business that is required to complete a cybersecurity audit or risk assessment under Cal. Code Regs. Tit. 11, §§ 7150 and 7210. Previously, only businesses that sold, shared, or received for commercial purposes the personal information of 10 million or more consumers were subject to metric reporting obligations. Additionally, reported metrics would have to include the number of requests to opt out of sale/sharing that were received from an OOPS. This would be a substantial reporting expansion for businesses, likely requiring many to report consumer request statistics that do not presently do so.

Changes to cyber audit and risk assessment certification

The proposed amendments clarify that certificates of completion for cybersecurity audits and risk assessments must be in writing but add the important qualifier that they are made “to the best of [the certifier’s] knowledge.” This would be a welcome change for those who were in line to execute the annual certifications, reflecting the reality that an absolute statement as to the accuracy of the certification would be almost impossible to achieve for most large businesses.

* * *

Although the amendments have a long way to go before becoming final, they could have a significant impact on businesses subject to the CCPA. If you have questions, would like to submit a comment on the regulations when they open for public comment, or need assistance with readiness work for new state consumer privacy laws in California or elsewhere, please contact the authors or your regular McDermott Will & Schulte lawyer.