With the introduction of the final regulations under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), consumers have more rights to limit the sale and sharing of their personal data than ever before. In particular, the CCPA gives consumers or their authorized agents the right to opt out of the sale of their personal information.[1] Adding on to the CCPA, the CPRA also gives consumers the right to limit the use and disclosure of sensitive personal information and to opt out of the sharing of personal information for cross-context behavioral advertising.[2]

Under the CCPA, businesses have an obligation to give consumers notice of their right to opt out and provide one or more designated methods for consumers to exercise that right, including an interactive webform accessible via a clear and conspicuous homepage link titled “Do Not Sell My Personal Information.”[3] Businesses must honor opt-out requests within 15 days of receipt.[4] The CCPA Regulations also indicate that businesses must treat user-enabled global privacy controls that communicate or signal the consumer’s choice to opt out of the sale of their personal information—controls such as a browser plug-in or privacy setting, device setting, or other mechanism—as valid requests to opt out for that browser, device, or (if known) consumer.[5] Similarly, the CPRA also addresses the implications of opt-out preference signals, giving businesses the option of honoring such signals in lieu of providing an opt-out link.[6]

On October 7, 2020, a coalition of organizations launched the Global Privacy Control (GPC) initiative to make it easier for consumers to exercise their privacy rights.[7] The GPC allows consumers to object to processing and/or opt out of the sale of personal information on several publisher websites via a single mechanism. Once a consumer enables the GPC to communicate privacy preferences, the browser sends a GPC signal to the websites the consumer visits and participating websites then respect the consumer’s privacy preferences.[8] If a publisher has not agreed to the GPC initiative, a consumer must set do-not-sell preferences on each publisher website. Thus far, several prominent companies including Mozilla, Brave, The New York Times, and The Washington Post have already agreed to honor the GPC signal.[9]

On January 29, 2021, California Attorney General Xavier Becerra expressed his support for the GPC initiative in a tweet:

California Attorney General Xavier Becerra Tweet
California Attorney General Xavier Becerra Tweet

Although this tweet is not a binding amendment or regulation of the CCPA, it nonetheless provides insight into the attorney general’s position on this issue and potential official policy positions that may be published in the near future. Critically, this tweet suggests that GPC opt-out signals communicate or signal a consumer’s valid choice to opt out and that the GPC “satisfies [the] legal requirements” under Section 999.315(c) of the CCPA Regulations.

Companies interested in avoiding regulatory enforcement or litigation may wish to heed the implications of this tweet and GPC opt-out signals, as a number of lawsuits have been filed against technology companies alleging that the companies violated the CCPA by stating that they do not sell personal information while using third-party cookies on their websites.[10] If a company does, in fact, sell personal information, the CCPA Regulations under Section 999.315(c) state that they must honor user-enabled global privacy controls such as a browser plug-in, privacy setting, device setting, or other mechanisms that communicate or signal the consumer’s choice to opt-out of the sale of their personal information.

[1] CCPA § 1798.120(a).

[2] CPRA § 1798.135(a).

[3] CCPA Regs at §§ 999.306(b)(1); 999.315(a).

[4] CCPA Regs at § 999.315(e).

[5] CCPA Regs at § 999.315(c).

[6] CPRA § 1798.135(b)(1).

[7] Global Privacy Control, Announcing Global Privacy Control: Making it Easy for Consumers to Exercise Their Privacy Rights, GLOBALPRIVACYCONTROL.ORG (Oct. 7, 2020), https://globalprivacycontrol.org/press-release/20201007.html.

[8] https://globalprivacycontrol.org/#faq.

[9] Id.

[10] Johnson v. Zoom Video Communications, Inc., No. 5:20-cv-02376, Doc. 1 (N.D. Cal. April 8, 2020) (Class Action Complaint; Demand for Jury Trial); G.R. v. TikTok, Inc., No. 2:20-cv-04537, Doc. 1 (C.D. Cal. May 20, 2020) (Class Action Complaint and Demand for Jury Trial).