Client Alert: California Signals a New Era of Privacy Enforcement: Global Privacy Control, Website Tracking, and the Expanding Obligations of Businesses

The National Law Review alert says California is signaling that businesses must do more than simply offer consumers the ability to opt out of the sale or sharing of personal information.[1] The alert says those preferences must be "technically implemented, consistently enforced, and honored before covered disclosures occur."[1]The alert also warns that with new browser requirements taking effect in 2027, businesses should reassess their consent management systems, tracking technologies, and cross-device privacy controls.[1]The authors say regulators are now examining whether the underlying systems operate consistently with the rights described in[1] privacy policies. They advise businesses to treat CMP implementation as an ongoing compliance process rather than a one-time deployment.[1]The privacy site gblock.app reports that on November 6, 2026, the Board of the California Privacy Protection Agency, which now calls itself CalPrivacy, adopted a stipulated final order requiring Federal Express Corporation to pay $2,975,000[2]. The same outlet reports that the board voted unanimously the same day to begin formal rulemaking on opt out preference signals[2].Ketch, a privacy software company, writes that the California Opt Me Out Act, signed into law in October 2025, will require browsers operating in California to build in an opt-out preference signal option directly[3].CalMatters reported in April that a webXray audit found possible "industrial-scale noncompliance with California requirements."[4] CalMatters also reported that a Google spokesperson said the company follows the law and called the audit "based on a fundamental misunderstanding of how our products work."[4]