Privacy & Cybersecurity Law Blog

On November 6, 2026, the California Privacy Protection Agency (“CalPrivacy”) unanimously voted to advance proposed amendments to its regulations to improve how businesses respond to consumers’ requests to opt out of the sale or sharing of their personal information. The proposal targets opt-out preference signals, which are browser-based signals that automatically tell websites that that the consumer has opted out of the sale or sharing of their personal information. The CCPA already requires businesses to honor these signals. The proposal follows findings by CalPrivacy, the California Attorney General and state lawmakers that businesses continue to ignore or fall short of state law requirements.

Key Proposed Amendments

The proposed amendments would:

• expand business reporting requirements to include disclosure of the number of opt-out-of-sale requests received through browser-based preference signals; and
• clarify that online platforms must honor opt-out preference signals before setting cookies or other tracking technologies on their websites.

CalPrivacy stated that the amendments largely would not impose new obligations. Instead, they are intended to give businesses guidance that improves compliance. The agency estimates that approximately 50,000 businesses would fall within the scope of the proposal.

Background and Stakeholder Input

In March 2026, CalPrivacy asked consumers and businesses for preliminary input on opt-out preference signals. In response, the trade group TechNet said businesses have “meaningful unequal capacity to process opt-out preference signals depending on their size and technical infrastructure”. The group noted that smaller businesses often rely on third parties, which can make “signal processing technically difficult even with genuine compliance intent”.

Regulatory and Enforcement Context

The proposal comes amid growing regulatory attention to opt-out compliance. Earlier this year, Oregon Senator Ron Wyden urged regulators in California, Colorado, and several other states to investigate businesses that he said were failing to honor consumers’ requests to opt out of the sale of their personal information. California, Colorado, and Connecticut are currently investigating businesses’ compliance with their states’ opt-out requirements.

CalPrivacy and California Attorney General Rob Bonta have also brought a series of enforcement actions against businesses that did not let consumers easily object to the sharing of their personal information.

Next Steps

CalPrivacy will open a formal 45-day public comment period on the proposed amendments. Businesses subject to the CCPA should consider reviewing how they detect and process opt-out preference signals. That review should cover whether signals are honored before cookies and other tracking technologies are deployed and whether opt-out requests are tracked well enough to meet expanded reporting requirements.