CCPA: What is Opt-Out Preference Signal (OOPS)

In an important step to simplify consumer privacy, California has introduced an opt-out preference signal (OOPS) in the California Consumer Privacy Act (CCPA) (https://www.uniconsent.com/ccpa). AB-3048, sponsored by the California Privacy Protection Agency (CPPA), passed the California legislature in August 2024 and would have enabled consumers to opt out of the sale and sharing of their personal information across multiple websites in a single, seamless operation. Governor Newsom vetoed it in September 2024, and its browser requirement returned in AB 566, the California Opt Me Out Act, signed on October 8, 2025.

California Consumer Privacy Act: Opt-Out Preference Signal

What is Opt-Out Preference Signals (OOPS)?

Opt-Out Preference Signals (OOPS) provide a convenient and automated way for consumers to exercise their right to opt out of the sale and sharing of their personal data across all businesses they interact with online. Rather than submitting individual opt-out requests to each business, OOPS enables users to communicate their preferences in one seamless action.

On February 26, 2024, the California legislature introduced AB-3048, which would have required all major browsers and mobile operating systems to support "opt-out preference signals" such as Global Privacy Control (GPC). This feature allows users to automatically express their privacy preferences, such as opting out of the sale of personal information, through browser settings. Governor Newsom vetoed the bill in September 2024, objecting mainly to the mandate on mobile operating systems.

Its successor, AB 566, makes it easier for consumers to exercise their rights under the CCPA, which already requires businesses to respect these opt-out signals. Companies that develop browsers such as Google Chrome, Apple Safari, and Microsoft Edge will be required to integrate an OOPS setting, making it easier for Californians to protect their personal data while browsing the web.

The Legal Framework

Signed into law on October 8, 2025, AB 566 requires businesses that develop or maintain a web browser to include a consumer-configurable setting that sends an opt-out preference signal from January 1, 2027, and allows the CPPA to adopt regulations to implement it. Unlike AB 3048, it does not cover mobile operating systems. Under existing CCPA regulations, businesses must already recognize these signals as valid requests to opt out of data sales or sharing.

This change will put California at the forefront of privacy initiatives in the U.S., with the potential to influence similar measures nationwide.

CalPrivacy rulemaking on opt-out signals

The California Privacy Protection Agency (CalPrivacy) is also preparing new rules on how businesses handle these signals. It invited preliminary comments from March 6 to April 6, 2026 and received 43 written comments. At the board meeting on August 6, 2026, staff recommended rulemaking on four points:

1. Naming GPC explicitly as an opt-out preference signal in the regulations.
2. Pseudonymous profiles: examples of how a signal applies to profiles tied to cookies or device IDs rather than a known person.
3. Reporting OOPS metrics: businesses reporting how many signals they receive and honour.
4. Timing: examples of how to handle tracking technologies that sell or share data before a GPC signal is processed, for example cookies that fire on page load.

As of October 26, 2026, CalPrivacy has not published proposed regulation text, so these are recommendations, not rules. The existing obligation already applies: under the CCPA regulations, a business must treat a valid opt-out preference signal as a request to opt out of sale and sharing.

Before January 1, 2027

From January 1, 2027, browsers have to offer the setting, so far more visitors will send the signal. Three checks are worth doing now:

• Detect the signal on the first page view. Read the Sec-GPC header or navigator.globalPrivacyControl before marketing and advertising tags load, not after the visitor opens the banner. This is the timing issue CalPrivacy wants to clarify.
• Pass the opt-out to your partners, for example through the US sections of the IAB GPP string.
• Apply it to known users. If a visitor who sends the signal is logged in, apply the opt-out to their account, not only to the browser.

UniConsent detects Global Privacy Control on the first page view, turns off the Targeting category on US consent banners and sets the opt-out in the IAB GPP string your ad partners read. Start a free trial to check how your site handles the signal.

What Does This Mean for Businesses?

Businesses will need to adapt to the new requirements, ensuring their systems can recognize and respect Opt-Out Preference Signals. For companies, it’s not just about compliance—it's about reinforcing consumer trust and providing transparent privacy practices.

The shift towards OOPS aligns with growing expectations for privacy-first operations in the digital age. Companies that adopt this approach will differentiate themselves in a competitive market by prioritizing user consent and data protection.

For more details on how UniConsent supports Global Privacy Control (GPC), get in touch with us today at hello@uniconsent.com.

---

About UniConsent

UniConsent is part of Transfon's privacy-first User Experience Platform, which serves millions of users daily. We offer seamless solutions to help publishers and businesses manage user consent and ensure compliance with privacy laws like GDPR and CCPA. For more information, contact us at hello@uniconsent.com.

---