Privacy, Cyber & Data Strategy Advisory | California Privacy Regulators Signal Increased Scrutiny Of Opt-Out Preference Signals, Data Broker Obligations, And Audit Readiness

On August 6–7, 2026, the California Privacy Protection Agency (CPPA) met to discuss heightened regulatory compliance expectations for businesses subject to the California Consumer Privacy Act (CCPA).

The CPPA voted to advance formal rulemaking on opt-out preference signals (OOPS), including Global Privacy Control (GPC), and on new audit requirements for data brokers under the Delete Act. It also approved increased data broker registration fees and outlined an expanding enforcement posture coordinated with other states.

Businesses and data brokers should assess their current compliance posture in light of these developments.

Key Takeaways

• The CPPA voted unanimously to initiate formal rulemaking on OOPS compliance, including codifying GPC as an example of a valid opt-out signal.
• Enforcement actions and CPPA commentary suggest businesses must demonstrate end-to-end implementation of opt-out signals from a consumer—not just a device or browser—across their technology ecosystems.
• Data brokers face a new 45-day operational processing cycle under the Delete Request and Opt-Out Platform (DROP), increased registration fees beginning in 2027, and mandatory independent third-party audits starting January 1, 2028.
• California is coordinating enforcement investigations with Colorado and Connecticut, signaling a multistate privacy enforcement approach.
• The CPPA’s Audits Division announced future priorities, including oversight of automated decision-making technology (ADMT), cybersecurity and risk assessment audits, and sector-focused audits.
• California’s Opt Me Out Act (AB 566) will require browsers to offer GPC functionality beginning January 1, 2027, expanding the signal’s reach.

Opt-Out Preference Signals: Formal Rulemaking Advances

The CPPA devoted substantial attention to OOPS, particularly GPC. The agency views OOPS compliance as a core operational requirement and expects businesses to demonstrate that opt-out signals are honored across their technology ecosystems.

The CPPA directed staff to initiate formal rulemaking. Staff indicated that the proposed rulemaking is expected to:

• Codify GPC as an example of a valid OOPS under the CCPA framework.
• Provide additional guidance through examples on pseudonymous profiles and linked identifiers, including whether cookie IDs, IP addresses, device identifiers, and browser identifiers should be associated for OOPS purposes.
• Replace the existing 10-million-consumer reporting threshold with a “significant risk to consumer security or privacy” standard aligned with risk assessment requirements and expand opt-out reporting obligations to include OOPS/GPC requests.
• Clarify OOPS processing timing expectations, reinforcing that privacy controls should be processed before personal information is sold, shared, or disclosed.

These expectations may evolve as the rulemaking process proceeds.

During the meeting, researchers discussed signal timing concerns, including situations in which advertising and analytics technologies load before consent tools. GPC can be available at the beginning of a page load before data sharing occurs, mitigating this concern. The discussion reinforced expectations that businesses must account for any delay in processing opt-out signals that could trigger noncompliance.

Mobile applications and connected devices remain outside the current browser-focused GPC framework, but businesses should watch for future guidance in these areas.

Enforcement Posture

California Deputy Attorney General Stacy Schesser emphasized three enforcement themes: (1) businesses must accept and process GPC signals; (2) businesses must verify that technical implementations work in practice; and (3) opt-out rights apply to consumers rather than merely to individual browsers or devices.

Schesser and CPPA members expressed skepticism toward arguments about technical and operational compliance burdens. They emphasized that businesses are responsible for honoring privacy rights across the information systems they create or deploy, regardless of complexity.

Delete Act: DROP Platform and Data Broker Requirements

The CPPA discussed significant developments under the Delete Act. The consumer-facing Delete Request and Opt-Out Platform (DROP) launched on January 1, 2026, and data broker processing obligations became effective August 1, 2026. Approximately 450,000 Californians have submitted requests, and more than 600 data brokers have registered on the platform.

Key data broker developments include:

• Data broker compliance is now described as an ongoing 45-day operational cycle of downloading deletion requests, matching and processing requests, applying exceptions, and reporting results through the platform.
• The CPPA unanimously advanced regulations increasing the annual data broker registration fee from $6,000 to $9,500 beginning in 2027.
• The CPPA unanimously advanced formal rulemaking for Delete Act audit requirements. Beginning January 1, 2028, data brokers will be required to undergo independent third-party audits every three years.
• The proposed audit framework would examine policies and procedures, system logs, matching methodologies, deletion records, suppression lists, and reporting activity. This signals a regulatory shift toward evidence-based compliance focused on operational testing rather than policy documentation alone.

CPPA Audits Division: Expanding Oversight and Enforcement Capacity

The CPPA Audits Division provided its first annual report and identified future priorities. Its proactive audit strategy aims to identify industry trends, recurring compliance gaps, and remediation opportunities.

Future priorities include:

• ADMT compliance oversight.
• Building cybersecurity and risk assessment audit capacity, including development of a submission portal.
• Sector-focused audits and public reporting.

The CPPA’s proposed FY 2026–27 budget is approximately $19.7 million, up about $3 million from the prior year. The budget includes funding for nine additional positions and reflects expanding responsibilities in enforcement, audits, rulemaking, and Delete Act implementation.

Legislative and Rulemaking Outlook

The CPPA continues to oppose federal privacy legislation that could preempt California law, such as the SECURE Data Act.

State momentum also continues for comprehensive privacy laws and Delete Act-style legislation in other jurisdictions. The CPPA also discussed Colorado’s revised ADMT legislation.

CPPA rulemaking priorities expected to be addressed in future meetings include:

• Reducing friction in exercising privacy rights (November 2026).
• Notices and disclosures (November 2026).
• Employee privacy requirements (February 2027).

The CPPA supports several pending California bills, including:

• SB 923, expanding the scope of the right to delete.
• AB 1542, prohibiting the sale or sharing of sensitive personal information.
• AB 322, increasing protections for precise geolocation data.
• AB 883, addressing data broker protections for public officials.
• SB 435, narrowing the publicly available information exemption.

The CPPA is also monitoring several other California bills, including measures focused on children’s safety.

Practical Next Steps for Businesses

In light of the CPPA’s actions, businesses and data brokers should consider the following steps:

1. Validate GPC and OOPS Implementation. Conduct technical testing to confirm that GPC and other opt-out preference signals are properly received, processed, and honored across all applicable systems and platforms.
2. Evaluate Cross-Device Opt-Out Propagation. Assess whether opt-out signals received in one context (e.g., a browser) are propagated to other environments where the same consumer’s data may be processed, particularly where cross-device advertising capabilities exist.
3. Review Pseudonymous Identifier-Linking Practices. Evaluate how cookie IDs, IP addresses, device identifiers, and browser identifiers are associated and whether those linkages create OOPS processing obligations.
4. Confirm Signal Timing. Ensure opt-out signals are processed before personal information is disclosed to advertising, analytics, and other third parties. Review the sequencing of consent tools relative to data-sharing technologies.
5. Operationalize DROP Compliance for Data Brokers. Implement the 45-day processing cycle for downloading, matching, processing, applying exceptions, and reporting back. Maintain documentary evidence supporting compliance at each stage.
6. Prepare for Audit Requirements. Organizations subject to future audit requirements should develop governance and documentation processes now, with a focus on demonstrable operational compliance rather than policy documentation alone.
7. Monitor AI Guidance. The CPPA’s focus on ADMT compliance oversight suggests forthcoming regulatory activity. Businesses deploying automated decision-making technologies should watch for new guidance.
8. Engage with Upcoming Rulemakings. Track proposed rules on friction reduction, notices and disclosures, and employee privacy requirements for comment opportunities.

We will continue to monitor developments from the CPPA and provide updates as formal rulemaking proposals are published. If you have questions about how these developments may affect your organization’s privacy compliance program, please contact a member of the Privacy, Cyber & Data Strategy team.