CalPrivacy and Attorney General actions, broken down by what regulators cited and what it means for a live website.
14 articles, newest first
Colorado's Attorney General calls the October 29 General Motors settlement the state's first under the Colorado Privacy Act. The cure period ended in 2025 and GPC has been mandatory since July 2024. Here is what that means for your website.
On November 6 the CalPrivacy Board voted to advance two preliminary rulemakings: one on privacy policy notices, one on friction in exercising CCPA rights. Staff want definitive sale/share statements, real retention periods, and cookie banners that explain the opt-out.
CalPrivacy fined FedEx $2.975 million on November 10. Its privacy policy said it didn't sell or share data while Meta, LinkedIn, Google and Adobe pixels ran, it ignored Global Privacy Control, and its cookie toggles didn't stop all sharing.
Thirty-six attorneys general settled with General Motors for $220 million on October 29 over driving and location data sold to brokers and insurers. GM's app told 370,000-plus drivers they weren't enrolled while the states say collection continued.
California's Attorney General settled with Lyft for $1.8 million on October 29. The app sold or shared rider and driver data for ads but offered no in-app opt-out, and made signed-in users log in again and hand over more information to use the web form.
CalPrivacy published draft amendments to its opt-out preference signal rules ahead of a November 6 board vote. The draft names Global Privacy Control and says ad pixels that fire before a consent tool checks for GPC violate the duty to opt out as soon as feasibly possible.
Updated
The provisions these articles turn on, with the text and a plain-language summary of each.
Put it to work
The free check sends a real GPC signal to one URL and shows whether marketing trackers stop. The full audit runs free from our homepage with no account; paying unlocks its evidence.