CalPrivacy Board advances rulemaking to update opt-out preference signals requirements

The California Privacy Protection Agency Board voted unanimously to commence a formal rulemaking on proposed amendments to California Consumer Privacy Act regulations on opt-out preference signals.

The proposed changes include the formal recognition of the Global Privacy Control as an OOPS and introduction of "examples of how OOPS applies to pseudonymous profiles, cookie-syncing, and browser features that disclose a consumer's personal information." They also introduce "metrics-reporting requirements to businesses that must conduct a cybersecurity audit or risk assessment."

After being formally published to the California Regulatory Notice Register and CalPrivacy's regulations portal, the proposal will be subject to an initial 45-day public consultation with 15-day consultations for subsequent draft changes.

The agency published initial drafts of its rulemaking notice and statement of reasons for the proposed updates.

The board previously discussed recommendations for opt-out signals during its August meeting, after staff outlined recommendations from stakeholders, including efforts to streamline compliance audits of its Delete Request and Opt-out Platform.

CalPrivacy Senior Privacy Counsel and Advisor Lisa Kim, CIPP/US, noted the amendments would require organizations to ensure their systems recognize opt-out signals and "must apply the opt-out across those digital properties."

She said the proposed changes clarify that a "browser feature that interacts with businesses on the consumer's behalf and makes that consumer's personal information available to those businesses must not interfere or prevent the sending of the consumer's opt-out preference to those businesses."

With the extension of metrics reporting to cybersecurity audit and risk assessment obligations, Kim indicated covered entities must also "include the number of opt-out requests they received through opt-out preference signals."

Agency priorities

Beyond the vote on formal rulemaking, CalPrivacy used its latest board meeting to review its 2026 legislative efforts, including the passing of the agency-sponsored bill, the Expanding Privacy Rights Act, which advances consumers' ability to request companies delete their personal data.

The agency also supported amendments to the Delete Act to require data brokers to process requests submitted through DROP within 30 days.

On the enforcement front, the agency highlighted its work with the California attorney general's office on a USD12.75 million settlement with General Motors over the sale of consumers' location and driving information.

CalPrivacy Deputy Director of Policy and Legislation Maureen Mahoney noted the agency has worked to streamline collaborations with California agencies, U.S. states and international regulators.

She said the various partnerships "are critical for enforcement collaboration, ensuring consistency of laws globally where possible, and spreading awareness about California's rights and protections."

CalPrivacy's potential priorities for 2027 include increased focus on biometric information, AI training practices and automatic license plate readers.

The agency is continuing to assess the potential risks of wearable technology and facial recognition systems. Without formal guardrails in place, Mahoney said such emerging technologies could have a "devastating effect on your ability to be anonymous in public." 

Gov. Gavin Newsom, D-Calif., vetoed a bill from California's 2026 legislative session that would have prevented wearable device users from recording individuals without consent.

With AI training, Mahoney noted state policymakers are also discussing potential opt-in obligations for AI companies to ensure consumers have control over what data is collected and used for AI training purposes.

CalPrivacy Board Member Drew Liebert said while he would welcome a bill requiring AI companies to obtain explicit consent before collecting consumer data, he "would anticipate the AI companies saying that's impossible."

Though companies previously warned they may face challenges when identifying what information could be considered personal data, CPPA Board Chair Jennifer Urban noted if organizations are collecting personal information, "you should take care to make sure that is being that is being appropriately protected."

"Especially once personal information is used to train these systems, it can be difficult to untrain them or, you know, remove that information," she added.

How to raise standards for informed consent

Carnegie Mellon University Professor Lorrie Cranor, CIPT, made a presentation to the board on the persistent challenges consumers face while navigating privacy notices and consent agreements. 

She offered a window into her prior research alongside Privacy Needs Company founder Aleecia McDonald that found found consumers would need approximately 244 hours a year to read every privacy policy they encounter online.

Cranor suggested standardized privacy disclosures, like nutrition labels, could help consumers compare organizations' data practices and better understand how their personal information is collected and used.

Consumer Reports Policy Analyst Matt Schwartz said while straightforward labels for privacy notices may be helpful in practice, he is "somewhat skeptical that we can ever make privacy policies into something that the average consumer is going to read and draw meaningful knowledge from just given the fact of how many businesses we interact with."

Cranor said labels are "necessary but not sufficient," adding, "there should be a decent baseline set of privacy protections, and then what you learn in the labels is what might go beyond that, and also what choices you have."

The presentation also covered how cookie consent interfaces can influence consumers' privacy decisions, particularly when websites make accepting cookies easier than rejecting them.

"Consumers need to know what the choices are and how they make those choices," Cranor said. "But underlying all of that, we need some minimum standards so that consumers aren't being asked to do things which are just fundamentally harmful to them."