Under the CCPA regulations, a logged-out visitor's browser sends an opt-out preference signal to a news site — what must the site do, and to what does it apply?

## What the signal is Under the CCPA as amended by the CPRA, an **opt-out preference signal** lets a consumer opt out of sale and sharing with every business they interact with online, without individual requests (11 CCR 7025(a)). Civil Code `1798.135(b)` refers to a signal sent with the consumer's consent by a platform, technology or mechanism, and `1798.135(e)` treats it as a way of authorising another person to opt out on the consumer's behalf. Under 7025(b), a business that sells or shares must process a signal as a **valid request to opt out** if: 1. it is in a **format commonly used and recognised** by businesses, such as an **HTTP header field** or a **JavaScript object**; and 2. the platform or mechanism sending it makes clear, in its configuration or public disclosures, that it is meant to opt the consumer out of sale and sharing. That disclosure need not mention California. A business that neither sells nor shares need not act on it. ## What the site must do for the logged-out visitor 7025(c) sets the scope: - Treat the signal as a valid `1798.120` opt-out **for that browser or device** and **any consumer profile associated with it, including pseudonymous profiles**. - If the consumer is **known**, apply it to the consumer too, including offline sale or sharing. - **Not require** more information than is needed to send the signal. It may offer an optional field, such as an email address, to extend the opt-out offline; if the visitor ignores it, the browser-level opt-out still applies. - Use any information collected with the request only to process it (7025(d)). The regulation's own example is exactly this visitor: a business that cannot associate the browser with an account must stop selling and sharing data tied to the **browser identifier**, but cannot apply the opt-out to the account because it does not know the connection. | Situation | What the opt-out covers | |---|---| | Logged-out visitor, no link to an account | That browser or device and its pseudonymous profile | | Logged-in or otherwise known visitor | Browser, device and the consumer's account, including offline sale or sharing | | Known visitor later arrives on a device without the signal | Opt-out stays; absence of the signal is not consent (7025(c)(5)) | | Visitor clears cookies and returns with the signal | Treated again at browser or device level | ## Conflicts - **Business-specific setting that allows sale.** The signal wins; the business may notify the consumer of the conflict and offer a way to consent, following 11 CCR 7004 (7025(c)(3)). - **Financial incentive that requires sale or sharing.** The business may ask the consumer to affirm that they intend to withdraw from the programme; if they do not affirm, it may ignore the signal for that programme while the consumer is known (7025(c)(4)). ## Frictionless or not `1798.135(b)(3)` lets a business elect between complying with subdivision (a), the links, and subdivision (b), the signal route. The regulations read that choice narrowly (7025(e)): it is a choice between **processing signals and posting the links**, or **processing signals frictionlessly and not posting the links**. It is never a choice between the links and the signals. **Frictionless** processing (7025(f)) means the business does not: - charge a fee or require valuable consideration for using the signal; - change the consumer's experience of the product or service; - show a notification, pop-up, interstitial or similar content in response to the signal (displaying that the opt-out was honoured is allowed). To drop the links, a business must also describe the signal route in its privacy policy and let the signal **fully effectuate** the opt-out (7025(g)). A business that also sells offline and would need extra information from the consumer to apply the opt-out there cannot use that route. ## Engineering consequences - Read the signal on every request at the edge, before any third-party tag fires. - Key the opt-out to the browser identifier and to every pseudonymous profile linked to it. - Persist the opt-out against the account once the visitor logs in, and do not clear it when a later session lacks the signal.