CPPA proposes amendments to CCPA opt‑out preference signal regulations to recognize GPC and expand reporting

Qué ocurrió

The California Privacy Protection Agency staff released a package of proposed amendments to the CCPA regulations on opt‑out preference signals (OOPS). The proposal would explicitly recognize the Global Privacy Control (GPC) as a valid opt‑out signal, add new examples for handling OOPS, and broaden annual metrics‑reporting obligations. The agency plans to open a 45‑day public comment period before formal rulemaking.

Por qué es importante para la confianza y el cumplimiento

• Its status is proposed. It is not law yet. Track it, but do not treat it as an obligation.
• The changes would tighten how businesses must honor GPC‑based opt‑out requests, impacting data‑sharing and advertising practices.
• It relates to CCPA/CPRA. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Revisit retention schedules and data minimisation for the data involved.
4. Inventory where this data is shared or sold and whether opt-outs are honoured.
5. Map the security requirements to existing controls and close gaps.
6. Inventory AI or automated decision systems in scope and their assessments.