We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSOpt Out Signal Workflow

California CCPA/CPRA Opt Out Signal Workflow

Detect a qualifying opt-out preference signal, treat it as a sale-or-sharing opt-out without requiring identity verification, apply it to the browser or device and any required known profile, and propagate the choice downstream.

The workflow captures detection, validity, scope, conflicts with account settings, systems and recipients updated, completion time, user feedback, testing, and reassessment when the ad-tech or signal implementation changes.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
3

Structured answer sets in this page tree.

Primary sources
3

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Under the California Consumer Privacy Act (CCPA), a business that sells or shares personal information must process a qualifying , such as Global Privacy Control (GPC), as a sale-or-sharing opt-out. Apply it to the browser or device and every associated profile, including ; if the consumer is known, apply it to that consumer as well. The California Privacy Protection Agency (CPPA) regulation controls the legal result, while the GPC specification is a non-binding technical reference for signal transmission and detection.

Section 1

How should the signal be detected and scoped?

Section 7025 covers signals in a commonly used and recognized format when the sending platform, technology, or mechanism makes clear that the signal expresses a choice to opt out of sale and sharing. Global Privacy Control is a representative technical implementation, but the CPPA regulation controls whether a signal qualifies and what the business must do. Detection should happen before covered tags, real-time bidding, audience transfers, or other sale or sharing can send the browser's or device's personal information.

Apply the signal using information already available. If the browser is tied to a pseudonymous profile, suppress that profile. If the consumer is logged in or otherwise known, extend the choice to the account and applicable offline sale or sharing. If no match exists, honor the browser or device scope and do not delay it while asking for optional identity information.

  • Edge owner: detect the signal on every covered web, mobile-web, and app surface before sale-or-sharing requests fire.
  • Identity owner: map the browser or device to and, when known, the consumer account.
  • Consent owner: store the opt-out state so a later visit without a signal does not reverse a known consumer's prior choice.
  • Product owner: display whether the business processed the signal as an opt-out.
Sources for this answer
California Consumer Privacy Act Regulations effective January 1, 2026
Section 7025 establishes qualifying signal characteristics, required browser, device, profile, consumer, and confirmation scope, and limits on added information.
Section 2

How should conflicts and frictionless processing work?

If a signal conflicts with a business-specific setting that allows sale or sharing, process the signal as an opt-out. The business may explain the conflict and ask for compliant consent, but it cannot treat the old setting as overriding the new signal. A financial-incentive program has a separate branch: when participation requires consent to sale or sharing, the business may ask whether the consumer intends to withdraw and must follow the regulation's result for the response.

Section 7025 defines by its conditions. It bars fees, valuable consideration, changed product functionality, and response pop-ups or interstitials, while allowing a status display. To omit the opt-out links under this route, the signal must fully effectuate the consumer's opt-out, including applicable offline sale or sharing. A business that needs extra information for offline matching cannot rely on that link exception and must keep the other designated opt-out method available.

  • Honor a conflicting signal unless the consumer later gives consent that meets section 7004.
  • Do not treat the absence of a signal on a later device as consent for a known consumer who previously opted out.
  • Keep a status display, but do not use a pop-up or changed functionality when claiming .
  • Retain the standard opt-out methods unless the business satisfies every condition for the regulatory link exception.
Sources for this answer
California Consumer Privacy Act Regulations effective January 1, 2026
Section 7025(c)-(g) governs conflicts, known-consumer persistence, frictionless processing, status displays, and the link exception.
Section 3

What should the workflow record and test?

Record the signal format and receipt time, browser or device identifier, matched profiles and account, systems blocked, downstream recipients notified when required, confirmation shown, optional information requested, offline scope, conflict handling, owner, and test evidence. Use the record only to implement, prove, and maintain the choice; do not repurpose it for advertising or unrelated profiling.

Test every release that changes tag loading, consent tools, identity stitching, account login, advertising destinations, mobile webviews, or offline matching. A successful banner choice does not prove signal handling: send the signal independently with a clean browser, a pseudonymous profile, a logged-in account, a mobile or webview surface, and a later session without the signal.

  • Verify no covered client-side request, server event, bid request, audience upload, or batch transfer leaves before the opt-out decision at each relevant collection point.
  • Confirm the choice reaches tags, server-side transfers, audience tools, profiles, accounts, and offline processes within scope.
  • Confirm the privacy policy explains device, browser, account, and offline handling and how consumers can use a signal.
  • Keep evidence of the request, resulting state, network behavior, account behavior, consumer confirmation, and remediation.
Sources for this answer
California Consumer Privacy Act Regulations effective January 1, 2026
Sections 7011, 7025, and 7026 support signal disclosures, data-use limits, confirmation, suppression timing, and downstream handling.
Recommended next step

Assign the CCPA opt-out signal work

Assign owners, evidence requests, review checkpoints, and operating records for opt-out signal handling.

Assessment workflow
Open Assessment Autopilot for California CCPA/CPRA

Turn Opt Out Signal Workflow into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review California CCPA/CPRA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Global Privacy Control specification
w3c.github.io
Referenced sections
  • Non-binding technical specification for transmitting and detecting the GPC signal; California law and regulations control the legal result.
Related guides

Explore more topics

California Data Brokers: CCPA, Registration, and DROP Duties
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
CCPA Contract Classification: Service Provider or Third Party?
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
CCPA Dark Patterns: Rules, Examples, and Review Checklist
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
CCPA Deadlines and Compliance Calendar
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
CCPA Do Not Sell or Share Guide
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
CCPA Do Not Sell or Share: Implementation and Testing
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
CCPA Do Not Sell or Share: Scope and Implementation
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
CCPA DSAR Workflow: Intake, Verification, and Response
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
CCPA Financial Incentives: Notice, Consent, and Data Value
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
CCPA Global Privacy Control (GPC): team obligations and technical implementation
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
CCPA Minors: Opt-In Rules for Consumers Under 16
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
CCPA Notice at Collection: Timing, Content, and Examples
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
CCPA Penalties and Fines: Current Amounts
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
CCPA Personal and Sensitive Information Categories
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
CCPA Privacy Policy Template: Required Content and Review
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
CCPA Risk Assessments, Cybersecurity Audits, and ADMT
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
CCPA vs CPRA: What Changed and Which Rules Apply
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
CCPA vs GDPR: Scope, Rights, Duties, and Evidence
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Does the CCPA apply to my business? Threshold guide
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
US CCPA Applicability Test Guide
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
US CCPA Compliance Checklist
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
US CCPA Compliance Guide
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
US CCPA Dark Patterns Guide
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
US CCPA Data Broker Crossover Guide
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
US CCPA DSAR Verification Guide
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
US CCPA Enforcement and Penalties Guide
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
US CCPA Financial Incentives Guide
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
US CCPA GPC Signal Guide
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
US CCPA Minors Guide
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
US CCPA Notice at collection Guide
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
US CCPA Personal and Sensitive PI Categories Guide
Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.
US CCPA Privacy Law FAQ
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
US CCPA Privacy Notices and Disclosures Guide
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
US CCPA Privacy Policy Guide
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
US CCPA Requirements Guide
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
US CCPA Scope and Thresholds Guide
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
US CCPA Service Provider Contractor and Third Party Contracts Guide
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
US CCPA Service Provider Contractor Contracts Guide
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
US CCPA Thresholds Guide
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
What must a CCPA privacy policy include?
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
What must CCPA service-provider contracts include?
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
What should teams do about consumer request verification under the CCPA?
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
When does the CCPA require risk assessments or cyber audits?
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.