CalPrivacy Advances Rules on Privacy Policies, Cookie Banners and Opt-Out Friction

If your privacy policy says you keep data "as long as necessary," or your cookie banner never mentions the word "sell," California's regulator has just told you it intends to write rules aimed at exactly that. Nothing is binding yet. But the direction is now on paper, and the next step could come as soon as February.

What Happened

At its November 6, 2026 meeting, the CalPrivacy Board voted 5-0 to move two preliminary rulemakings forward, one on notices and disclosures and one on reducing friction when consumers use their CCPA rights, according to Privacy Daily's report of the vote. Staff had built both sets of recommendations from public comments: more than 40 on friction and more than 20 on notices. The same meeting authorized the formal GPC rulemaking and approved the FedEx order.

The notices deck asks for a short summary at the top of every privacy policy with links to the rights portal or webform, and for businesses to publish their prior privacy policy. It would also add guidance that the sale/sharing disclosure must be a definitive past-tense statement ("In the past 12 months, we did/did not sell or share") and that "as long as necessary" doesn't count as a retention period. Financial incentive notices would have to name the program and give its URL.

The friction deck goes further into how websites behave. Its recommendations include:

• A business that uses a cookie banner to handle opt-outs must explain how cookie preferences relate to opting out of sale or sharing.
• An explicit ban on hiding rights information (no-index code is the deck's example), leaving broken links or request email addresses unfixed, stacking CAPTCHAs, and making people fill out duplicate forms.
• Withdrawing consent should take as few steps as giving it.
• Businesses would confirm receipt of a verifiable request as soon as feasible and within 10 days, under a change to § 7021.

Staff also proposed a free agency tool that lets consumers file one request covering every CCPA right, plus a webform template for businesses.

What It Means for Website Owners

These are recommendations, not regulations. Staff said draft text could come back for a vote at the Board's February 4-5, 2027 meeting; after that it would go out for public comment, the same way the GPC package did, so final rules are still months off. The awkward part is that several items are framed as clarifications of duties that already exist. Section 7004 already prohibits needless friction, and the FedEx order faulted a cookie panel that never explained how it related to sale or sharing.

So the cheap move is to check now. Read the sale/share sentence in your policy and ask whether it is a clear yes or no for the last 12 months. Replace open-ended retention language with actual periods. Send a test message to your privacy request address, click every rights link in your footer, and confirm your banner's text says what rejecting cookies does to sale and sharing.

Where Privisy Fits

A Privisy audit already covers a good share of this list from the outside. It reads the policy's 12-month sale/share disclosure and flags it when the trackers it observes contradict it, checks that the privacy request email domain can receive mail, confirms a request mechanism and Do Not Sell or Share link exist, and compares the steps to accept against the steps to reject. When draft text lands in February, we'll map any new duties to checks and say so here.