Browser opt-out signals arrive at scale on January 1, 2027. Here is how to know your site honors them.

October 2026. Feroot does not provide legal advice. Consult your own counsel.

TL;DR

• From January 1, 2027, a business that develops or maintains a browser must give California users a setting that sends an opt-out preference signal, such as Global Privacy Control (Civil Code 1798.136, the Opt Me Out Act, AB 566). The duty to honor the signal has always sat with the website. What changes is the volume.
• The CCPA tracker penalties so far share one failure, an opt-out that did not work: Sephora, Todd Snyder, Healthline, Tractor Supply, Disney and ABC. The regulators tested the page, not the policy.
• The Tractor Supply order (CalPrivacy, September 2025) is the checklist: scan every digital property at least quarterly, keep a current tracker inventory with purpose and contract, honor opt-out signals, certify it yearly.
• Verify what fires after an opt-out, on every page, before January.

What the law already requires

If the CCPA covers your business, you must treat an opt-out preference signal as a valid request to opt out of the sale or sharing of personal information. "Sharing" includes disclosures for cross-context behavioral advertising, which is what most advertising pixels do.

This is exactly what the California Attorney General's first CCPA settlement turned on. In the 2022 Sephora case, the site's trackers counted as sales, and the site ignored Global Privacy Control signals.

What changes on January 1, 2027

AB 566 adds Civil Code 1798.136, which requires browsers to include a setting consumers can turn on to send an opt-out preference signal. Today, most of these signals come from privacy-focused browsers and extensions. Starting in January, they can come from any browser whose maker complies with the law.

CalPrivacy has also directed rulemaking to name Global Privacy Control in the regulations and to tighten how signals must be honored. Your site will receive more signals, but the standard for handling each one stays the same.

What regulators have penalized

The largest CCPA settlement to date, General Motors at $12.75 million in May 2026, concerned the sale of driving data and is a data-minimization case, not a tracker case. The tracker cases share one pattern: a privacy choice was recorded, and the page did not act on it.

The Tractor Supply checklist

The CalPrivacy order of September 2025 spells out what the regulator considers fixed. It is the clearest public description of a working program:

1. Scan your digital properties at least quarterly and keep a full, current inventory of tracking technologies.
2. For each one, record whether it is used for a selling or sharing purpose and whether a contract meeting CCPA requirements supports it.
3. Configure properties so that opt-out preference signals are recognized and given full effect, including for known consumers.
4. Either honor signals in a frictionless manner or provide a "Do Not Sell or Share My Personal Information" link that actually effectuates the opt-out.
5. Confirm required contract terms with every external recipient of personal information.
6. Have an officer or director certify compliance each year, and review the third parties receiving personal information annually.

What to verify before January

• What fires after an opt-out. On every page, not the home page. Trackers added by a tag manager update or a new vendor are the usual regression.
• What fires before any choice. Pre-consent firing is the most common failure, including with tag-manager-based consent integrations.
• Across sessions and devices. The Disney finding was a signal honored on one device only.
• Who receives the data, and under what contract. Service provider or third party changes the legal answer.

How DXComply supports this

DXComply continuously discovers every script, pixel and tag on your websites and mobile apps, along with the endpoints they send data to. It detects missing or misconfigured consent banners, opt-outs that do not take effect, and trackers that load before consent. It checks downstream scripts against the visitor's choice in every consent state. It also keeps a continuous inventory and audit trail, so your quarterly scan and annual certification rest on evidence rather than sampling.

DXComply works alongside OneTrust, Cookiebot, TrustArc and other consent platforms. The CMP records the choice, and DXComply shows what happened next. Request a demo and we run it on your own pages: what fires before any choice, what fires after an opt-out, and where it goes.

Frequently asked questions

Do we have to honor Global Privacy Control today? Yes, for sale and sharing opt-outs under the CCPA. AB 566 changes how many signals arrive, not whether they count.

We have a consent platform. Isn't this handled? A consent platform records and manages choices. The enforcement actions above involved companies with consent tools in place. Verification of what fires after a choice is a separate step.

What about the new deletion rules (SB 923)? From January 1, 2027 the right to delete covers personal information a business collected from or about a consumer, including purchased and inferred data, with suppression lists allowed and a webform required for online-only businesses. That is a data-mapping and deletion-workflow change for your privacy team and request tooling. DXComply's inventory of third parties receiving data from your site feeds into that map, but it is not a deletion tool.

Related reading

• DXComply
• Consent Audit: Verify Your CMP Does What It Promises on Every Page