Six years on from the CCPA’s effective date and CalPrivacy is still seeing businesses fail to honor a key requirement: accepting opt-out preference signals (OOPS) like the Global Privacy Control (GPC). Proposed amendments to the CCPA rules are aimed at underscoring when and how businesses must honor OOPS.
The amendments aren’t introducing new requirements so much as clarifying existing ones. The amendments would name the GPC expressly as an opt-out preference signal and add examples covering pseudonymous profiles, cookie-syncing, and browser features that disclose personal information.
One example is worth underlining: to meet the timing requirements, a business has to determine whether it has received a signal before it sets cookies or other tracking technologies that facilitate selling or sharing. Read that twice. (I did.)
None of this is final. The board meets November 5 and 6 and may vote to advance the text to formal rulemaking. But when a regulator tells you where it has seen failures, it’s also telling you where it will look. Check whether your site looks for the signal before anything fires.
Arlo
New From Osano
Release Notes: October
Check out what’s new in the Osano platform from the month of October, including changes to cross-device consent banners, web app navigation, and reporting.
In Case You Missed It...
Blog: 7 Takeaways from PSR 2026 (and What They Mean for Your Privacy Program)
The Osano team recaps their experience at the IAPP PSR conference in Seattle, covering seven themes from AI agents and consent gaps to tracking lawsuits and California audits.
Top Privacy Stories of the Week
CalPrivacy Proposes Amendments to Opt-Out Preference Signal Rules
The California Privacy Protection Agency (CalPrivacy) released proposed amendments to its opt-out preference signal rules, which it says mostly clarify existing requirements rather than create new ones. These clarifications focus on handling opt-out preference signals (OOPS) primarily, with some changes focused on metrics reporting as well.The board meets November 5 and 6 and may vote to advance the text to formal rulemaking, so none of it is final.
Newsom Vetoes California Smart-Glasses Recording Bill
Governor Gavin Newsom recently vetoed SB 1130, which would have required wearable devices sold in California from 2028 to show a visible or audible indicator while recording and made it a misdemeanor to record people without consent where they expect privacy, such as offices and retail stores. Newsom said the bill was too broad and could sweep in smartwatches and other common devices, and that existing law already criminalizes recording people where they expect privacy.
California Settles with 23andMe’s Successor Over Breach and Genetic Data Sale
California Attorney General Rob Bonta announced a $6 million settlement with Chrome Holding Co., the former 23andMe, over claims it failed to protect customer data before a 2023 breach. The deal also resolves the state’s challenge to the sale of customers’ genetic data and samples in bankruptcy. Neither side admitted liability, and the settlement still needs approval from the bankruptcy court.
Indian News Publishers Challenge the DPDP Act
The Digital News Publishers Association, which represents the digital arms of 21 major news organizations, filed a petition on October 27 calling parts of India’s Digital Personal Data Protection Act, 2023 unconstitutional. An independent journalist, Yukta Mudgal, filed separately. Their counsel argued the Act has no journalism exemption and would effectively require reporters to seek permission before reporting, a “regime of pre-censorship.” The petitioners also object to the executive’s control over appointments to the Data Protection Board and to a change to the RTI Act.
EU Council Backs AI Training on Personal Data Under Legitimate Interest
On October 21, the Council of the European Union agreed its negotiating position on GDPR changes in the Digital Omnibus package. The provision would explicitly allow processing personal data to develop and operate AI systems under the legitimate interest basis. Companies would still need safeguards and would still have to respect the right to object. Max Schrems of noyb called the move “digital expropriation.” It’s a negotiating position, not law, and Parliament has to set its own before talks can reach a final agreement.
Like What You See in the Privacy Insider newsletter?
There's more to explore:
🛠️ The Osano Engineering Blog
Learn what we're building, why, and how! New posts released monthly here.
📱 The Osano Subreddit
Join our official subreddit to stay up to date on the latest news, analysis, guidance, and content from Osano!
đź“– The Privacy Insider: How to Embrace Data Privacy and Join the Next Wave of Trusted Brands
The book inspired by this newsletter: Osano CEO, Arlo Gilbert, covers the history of data privacy and how companies can start building a privacy program from the ground up. More details here.
If you’re interested in working at Osano, check out our Careers page!
