The California Privacy Protection Agency has proposed amendments to the CCPA regulations concerning opt-out preference signals (OOPS). These amendments highlight the Global Privacy Control (GPC) as a signal businesses must recognize as a valid opt-out of sale or sharing. The proposal includes examples and expands metrics-reporting obligations. The CPPA Board is expected to open a 45-day public comment period at its November 5-6 meeting.
Although this is not final text, the examples indicate how the Agency expects current obligations to be implemented. This checklist helps you evaluate your setup against these expectations. Each item has a clear done/not-done state and a description of what effective compliance looks like.
Prerequisites
Before you begin, gather the following:
- An inventory of all properties where you sell or share personal information
- Your current Consent Management Platform (CMP) configuration and Tag Manager setup
- A list of third-party trackers and ad-tech vendors on your sites
- Your current determination of whether you must complete a cybersecurity audit or risk assessment under the existing CCPA regulations
- Access to someone who can run browser tests with GPC enabled
Checklist
1. Confirm your CMP detects GPC.
Test with a GPC-enabled browser to ensure your CMP registers the signal. Done means you've documented a repeatable test and its result. Effective compliance: the signal is recognized on every property, on every page template, without the visitor interacting with the Consent Notice.
2. Check timing of signal detection.
GPC arrives with the browser's initial request. Proposed examples expect you to check for it before any cookies or pixels that sell or share personal information activate. Load the page with network inspection open and look for requests firing before your CMP evaluates the signal. Effective compliance: no sale/share tags, pixels, or third-party cookies fire before the signal check.
3. Block cookie syncing when a signal is present.
A business receiving an OOPS must prevent third-party trackers from initiating or performing cookie syncing for cross-context Behavioural Advertising. Audit your ad-tech vendors for sync calls and confirm they're suppressed when GPC is detected. Effective compliance: a GPC-enabled session produces no sync requests, verified in a network capture saved as evidence.
4. Map your device-linking practices.
If you link a consumer's devices into a pseudonymous profile, a GPC signal from one device must apply to all linked devices. If data is kept in unlinked, device-specific form, the signal applies only to that device. Document which model you use. Effective compliance: a written description of your identity-resolution approach, with opt-out propagation logic matching it.
5. Verify propagation to downstream systems.
Detecting the signal isn't enough. Trace the opt-out from the browser through your CMP, Tag Manager, data warehouse, and any vendor receiving sale/share data. Effective compliance: a data-flow diagram showing where the signal is honored at each step, plus a test record proving the flag reached each system.
6. Treat GPC as a valid opt-out request, not a hint.
Review your internal policy language. If your procedures describe browser signals as advisory or require a second confirmation click, rewrite them. The proposal identifies GPC as a valid opt-out request. Effective compliance: your written procedures state that a detected signal is processed as a sale/share opt-out, with no extra steps for the consumer.
7. Review browser-feature interactions.
The proposal states browser features that interact with businesses on a consumer's behalf must not prevent or interfere with the consumer's OOPS from being sent. Test across browsers and note where signals aren't transmitted so you can explain gaps. Effective compliance: a browser test matrix with dates and results.
8. Determine your metrics-reporting scope.
Annual metrics reporting is currently limited to businesses handling the personal information of 10,000,000 or more consumers. The proposal would extend it to any business required to complete a cybersecurity audit or risk assessment. Check whether you fall into that group. Effective compliance: a documented scope determination, signed off by legal, revisited when the final text is adopted.
9. Build the OOPS request counter.
Covered businesses would separately report opt-out requests received through an OOPS. Start logging signal-based opt-outs now, distinct from form-based requests. Effective compliance: a queryable record of signal-based opt-outs by date and property, exportable without manual reconstruction.
10. Align audit attestations.
The proposed changes include a "to the best of my knowledge" qualifier for the cybersecurity audit attestation. Brief whoever signs these attestations so they understand how privacy signal handling connects to your audit and assessment work. Effective compliance: a named owner, a review calendar, and supporting evidence on file.
11. Calendar the rulemaking.
If the Board advances the package, expect a 45-day comment period and possibly an additional 15-day period for related modifications. Assign someone to track dates and decide whether to file comments. Effective compliance: dates on a shared calendar and a named owner.
Common Mistakes
- Honoring GPC only after tags fire. A signal checked late is a signal missed. Sequence matters.
- Applying the signal to the browser session only. If you link devices into a profile, the opt-out needs to follow the profile.
- Forgetting vendors. Your CMP may honor GPC while a third-party script still runs cookie syncing.
- Assuming you're out of scope for reporting. The trigger is your audit or risk assessment obligation, not only consumer volume.
- Keeping no test evidence. If you can't show how you verified GPC handling, you can't defend it.
Next Steps
Start with items 2 and 3, because timing and cookie syncing are where technical gaps often hide. Then run the scope check in item 8 so you know early whether reporting applies to you. The proposed text may change after comment, so treat this checklist as a baseline and revisit it when the Board acts and any final regulations are published.
