CalPrivacy's Draft GPC Rules Say Pixels Can't Beat Your Consent Tool

If your ad pixels load in the same split second as your consent tool, California's privacy regulator has now put in writing that it considers that a violation. Two weeks ago we covered CalPrivacy's plan to open a Global Privacy Control rulemaking. The draft text is out, and it gets far more specific about tag managers and ad tech than the current rules do.

What Happened

CalPrivacy posted proposed amendments to § 7025, § 7026, § 7102 and six other sections of the CCPA regulations as materials for its board meeting on November 5–6 in San Francisco. The draft is dated October 8; trade coverage picked it up on October 27. Item 9 on the November 6 agenda is a discussion and possible vote to advance the package to formal rulemaking, which would open a public comment period. None of it binds anyone yet.

The additions that matter most for a website:

• GPC by name. § 7025(b)(1) would list Global Privacy Control as an example of a valid signal format.
• Tags that beat the consent tool. A new example under § 7026(f) describes a retailer whose advertising and analytics cookies and pixels are set before its consent management platform and tag manager check for GPC. Because the opt-out arrives with the browser's very first request, the draft says that setup fails the duty to comply "as soon as feasibly possible."
• Cookie syncing. When a site receives the signal, it must stop third-party trackers on its pages from starting or performing cookie syncing for cross-context behavioral advertising.
• Linked devices. A business that ties a visitor's laptop and phone into one pseudonymous profile, through fingerprinting for example, would have to carry a GPC opt-out sent from the laptop over to the phone. One that keeps data in unlinked, per-device form only owes the opt-out on the device that sent it.
• Browser features. A new § 7025(h) says a browser feature that interacts with a business on the consumer's behalf can't block or contradict their opt-out signal.

Separately, § 7102 would make large businesses that publish request metrics count signal-based opt-outs on their own line.

What Website Owners Should Do

Start with the tag-ordering example, because it describes how a lot of sites actually load: a tag manager container, a handful of pixels and a consent banner all initializing on first paint. If a pixel wins that race, the draft treats the data it sent as already sold or shared, even when the consent tool shuts things down a moment later. The fix is either to have the consent tool resolve before the tag manager fires any advertising tag, or to have the tag manager read navigator.globalPrivacyControl itself before firing anything that sells or shares. Then open your site with GPC switched on and read the network log from the first request, not from the point where the banner appears.

Ask your vendors whether their tags still sync IDs on a page that received GPC, and whether any identity product you use links devices into one profile. If it does, a browser-only opt-out won't satisfy the draft.

AB 566 requires browsers to offer an opt-out signal setting from January 1, 2027, so more California visitors will arrive with GPC on around when these rules could become final.

Where Privisy Fits

Privisy's GPC validation loads your site with the signal on and with it off, and records the advertising and analytics requests each visit makes from the first page load onward. A pixel that fires before your consent tool reads GPC shows up as a finding. The full audit also checks your .well-known/gpc.json declaration and the "Opt-Out Request Honored" status display § 7025(c)(6) already requires. What a scan can't see is server-side ID matching inside your vendors' systems; that part still takes a conversation with them.