CCPA/CPRA § 7025(c)(3)
GPC: Conflict with Business-Specific Privacy Settings
The Privisy audit tests this section. See the checks
- Source
- Regulation
- In force from
- January 1, 2026
- Last reviewed
- September 2026
- Framework
- CCPA/CPRA
What it requires
When an opt-out preference signal conflicts with a consumer's existing business-specific privacy setting that permits sale or sharing, the business must still process the signal as a valid opt-out request. However, the business may notify the consumer of the conflict and provide an opportunity to consent to sale or sharing using the consent procedures in section 7004. If the consumer consents, the business may ignore the signal for as long as the consumer is known to it. The Register 2025, No. 39 amendments (operative January 1, 2026), however, added a closing sentence that makes the escape route conditional: the business must still display the status of the consumer's choice in accordance with § 7025(c)(6) and § 7026(g). Ignoring a signal on the strength of a consent the consumer gave is permitted; ignoring it silently is not.
Regulation text
If the opt-out preference signal conflicts with a consumer's business-specific privacy setting that allows the business to sell or share their personal information, the business shall process the opt-out preference signal as a valid request to opt-out of sale/sharing, but may notify the consumer of the conflict and provide the consumer with an opportunity to consent to the sale or sharing of their personal information. [...] If the consumer consents to the sale or sharing of their personal information, the business may ignore the opt-out preference signal for as long as the consumer is known to the business, but the business must display the status of the consumer's choice in accordance with section 7025, subsection (c)(6), and section 7026, subsection (g).
California Consumer Privacy Act / California Privacy Rights Act, § 7025(c)(3)Read the full section from California Privacy Protection Agency (CalPrivacy)
How Privisy tests it
- Global Privacy Control (GPC) Signal
Where the signal conflicts with an existing business-specific setting it must still be processed, though the business may seek § 7004 consent to sale or sharing (§ 7025(c)(3)); a § 7025(f)(3) settings link is another consent route, and a generic cookie Accept is not that consent (Privisy reading of Civ. Code § 1798.140(h))
- GPC Status Display
Status display still owed when the signal is set aside on the consumer's separate consent (statusDisplayPolarity set-aside, issue 1329)
- GPC Consent Override (§ 7025(f)(3))
Conflict notification permitted, but signal must still be processed
The audit runs these checks against your live site and shows the evidence behind every result.
Get Your AuditThis page is for information only and is not legal advice. The excerpt is reproduced from official public sources and was checked against them on the last-reviewed date above. Laws change: check the authoritative source and consult a licensed attorney for compliance guidance.