CalPrivacy Plans a November Rulemaking on Global Privacy Control

California already requires your site to treat a Global Privacy Control signal as an opt-out of sale and sharing. What it hasn't done is spell out, in the regulation itself, which signal counts and how fast you have to act on it. That gap looks set to close, and the agency now has a month attached to it.

What Happened

Speaking on a panel at the IAPP privacy and AI governance conference in Seattle, Maureen Mahoney, CalPrivacy's deputy director of policy and legislation, said the agency expects to open a formal rulemaking in November covering GPC and other issues, Privacy Daily reported on October 13. No proposed text has been published yet.

The groundwork was laid at the CalPrivacy Board's August 6–7 meeting, where staff (Lisa Kim and Rianna Grenda) presented four recommendations after collecting 43 written comments running to 376 pages. The board voted to move forward, and Alston & Bird reported that vote as unanimous. The four recommendations, as listed in the staff slides:

• Name GPC explicitly as an opt-out preference signal.
• Add examples showing how the signal applies to pseudonymous profiles, the cookie IDs, device IDs, and similar identifiers ad platforms build audiences on.
• Require businesses to report opt-out preference signal metrics.
• Add examples on timing, meaning when a site has to act on GPC relative to the tracking technologies that sell or share data.

The timing matters because AB 566, the California Opt Me Out Act, takes effect January 1, 2027. From that date, any business that develops or maintains a web browser must ship a setting that sends an opt-out preference signal. So the number of Californians arriving at your site with GPC switched on is likely to jump at roughly the same moment the rules for handling it get sharper.

What Website Owners Should Do

Nothing changes legally until a final rule is adopted, and the proposal will go through a public comment period first. But the direction is clear enough to act on now, particularly on timing. At the August informational session, Northeastern University professor Christo Wilson walked the board through the problem: a page loads its scripts in order, and if an ad pixel fires before the consent manager has read the signal, the data is already gone. If your tag setup works that way, expect the new examples to say it doesn't count.

Load your site with GPC on and watch the network panel for requests to advertising and social domains that go out before your consent tool runs. Check whether opting out actually reaches the pseudonymous identifiers your ad partners use, not just the logged-in account record. And if you're large enough to fall under the existing opt-out reporting rule, start counting GPC requests separately so a new metric doesn't catch you without the data.

Comments will open once the proposal is published. If you run a complicated adtech stack, that's your chance to explain it to the agency.

Where Privisy Fits

Privisy's GPC validation visits your site twice, once without the signal and once with it, and compares which trackers load. A full audit also flags marketing tags that fire before consent, checks your .well-known/gpc.json declaration, and looks for the "opt-out request honored" display California already requires. Those are the behaviors this rulemaking is aimed at, so a scan now shows you where your site stands before the proposed text arrives.