Vendor Highlights California's 2026 ‘Under the Radar’ Privacy Changes
There are privacy rules taking effect Thursday in California that have gone “a little bit under the radar,” but companies are beginning to pay attention to them “at the last minute,” Sourcepoint Chief Privacy Officer Julie Rubash told us in an interview.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Some updates to the California Consumer Privacy Act (CCPA) are “very surface-level changes,” she said. That makes it “easy for regulators to see” if companies aren’t complying by just scanning a website. “Those tend to be the gatekeeper types of issues that lead to investigations.”
For example, she cited two changes related to the opt-out functionality that begin Thursday. The first covers whether the Global Privacy Control (GPC) signal is honored. When someone visits a site with their GPC signal enabled, they should "see something somewhere on the website" that says "GPC is honored" or "Opt-out signal is honored," Rubash said.
Another change requires that users are given a way to verify whether they have opted out of the sale or sharing of their personal data. This could be shown through a toggle within privacy settings or another mechanism, Rubash said.
In addition to these notices, she said regulations now prohibit the use of double negatives in privacy settings, an effort to clarify the language after it was found to be “very confusing.”
“A lot of settings would have [an] ‘off, on’ or a ‘yes, no’” toggle, which made it hard for consumers to understand if they were opting in or opting out of selling and sharing, Rubash said. “Now the regulations say you have to have some kind of explanation as to what each … setting actually means.”
While CCPA changes related to automated decision-making (see 2509230036) and risk assessments “monopolized” the news on the rule updates, it's “important that companies pay attention” to others, too, Rubash said.