California: How a Signal Acquires Legal Force
California’s regulations effective January 1, 2026 provide a precise test for an online opt-out preference signal. The question is not whether a business can detect a browser setting, but whether the signal communicates a sale/sharing choice in a form the business recognizes and what the business can connect that choice to. Understanding that test lets a reader distinguish a valid request from an ordinary preference value, then determine what the request covers when the business knows only a device, a pseudonymous profile, or a consumer account.
The California model is useful because it makes legal scope explicit. A signal can have real legal effect without identifying a person by name, but its reach is not unlimited. The business must honor the request at the level the rule recognizes, and it may extend that reach when it already knows enough to connect the browser or device to additional records. It cannot turn optional identity information into a prerequisite for honoring the initial request.
A valid signal has meaning, not just syntax
California defines an opt-out preference signal as a signal sent by a platform, technology, or mechanism on behalf of the consumer that communicates the consumer’s choice to opt out of the sale and sharing of personal information. The definition does two things at once. It identifies the technical carrier—a platform, technology, or mechanism—and it identifies the legal content: a choice about sale and sharing. The carrier matters because it sends the choice across businesses. The content matters because it tells the receiving business which right has been exercised.
The regulation then sets conditions for treating the signal as a valid request. First, the signal must use a format commonly used and recognized by businesses. An HTTP header field or a JavaScript object can serve as an example. This is a practical interoperability requirement: the receiving business must be able to detect and interpret the message as part of ordinary online traffic rather than depend on an unusual private exchange.
Second, the mechanism must make its meaning clear to the consumer. Its configuration or its public disclosures must explain that using it is intended to opt the consumer out of the sale and sharing of personal information. The disclosure does not have to mention California specifically. What matters is that the consumer is not unknowingly sending a value whose legal effect exists only in the business’s internal interpretation.
Third, the recipient must be a business that sells or shares personal information. The rule’s mandatory processing duty is tied to that activity. A signal that communicates an opt-out of sale or sharing does not automatically impose the same duty on an organization whose relevant practices fall outside that scope. The right and the regulated activity remain connected.
These elements show why the signal is more than a cookie control. A setting can tell a browser not to retain a cookie, block a category of storage, or change a local preference. California’s opt-out preference signal instead communicates a direction to the business about what the business does with personal information after collection: do not sell or share it to third parties. The machine-readable format makes the request scalable, but the legal effect comes from the combination of communicated meaning and the rule that binds an in-scope business.
The business therefore has a translation task. It must recognize the message, determine that it carries the stated opt-out meaning, and treat it as a request under the California right to opt out of sale or sharing. The business is not free to respond that the consumer failed to navigate to its own privacy page. The point of the signal is to avoid an individualized request with every business the consumer encounters online.
That translation also has a negative boundary. California’s regulations do not identify a particular browser, vendor, or commercial protocol as automatically valid. They provide the legal conditions and examples of formats, not a list of product endorsements. A technical implementation still has to communicate the required choice, and a business still has to apply the rule to its own sale or sharing practices. The regulation supplies the legal test; it does not make every message that resembles a privacy signal pass that test.
California’s scope expands only when the business can connect it
Once a compliant signal is received, California starts with the browser or device. The business must treat the signal as a valid request to opt out of sale or sharing for that browser or device and any consumer profile associated with it, including pseudonymous profiles. A pseudonymous profile is not the same as a named account. It may be a record connected to a browser identifier or another online identifier that the business uses to organize information without knowing the consumer’s name. The rule nevertheless recognizes that profile as part of the device-linked surface that the request can protect.
This creates a meaningful legal result for an anonymous visitor. Suppose a person visits a website with a qualifying signal enabled but is not logged in, and the business cannot connect the browser to an account. The business still has to stop selling or sharing the information linked to the browser identifier for the covered purpose. It does not have to pretend that it knows who the visitor is. The request is valid at the scope the business can observe: the browser, device, and associated profile.
The result changes when the business already knows the consumer. If the person is logged in, or the business can otherwise associate the browser or device with a consumer profile or account, the business must also treat the signal as a valid request for that consumer. The connected scope may include the account and offline sale or sharing when the business has the information needed to apply the choice there. The important direction of reasoning is from available association to broader effect. The business does not receive a general license to identify every visitor merely because a signal arrived.
The difference can be expressed as a ladder:
- Signal source: the browser or device that transmits the choice.
- Associated online surface: profiles, including pseudonymous profiles, that the business links to that browser or device.
- Known consumer: an account or consumer identity the business already knows to be connected to the interaction.
- Additional records: offline sale or sharing that the business can reach because the connection supplies the information needed to apply the request.
Each step depends on the business’s actual ability to make the connection. The signal is legally meaningful at the first step; later steps do not determine whether the initial browser/device request exists. This distinction prevents two opposite errors. One error is to say that an anonymous browser request has no legal effect because the business cannot name the person. The other is to say that a signal automatically reaches every record the business holds about an unknown individual.
Consider two visits to the same online retailer. On the first visit, the browser sends the signal while the visitor remains unknown to the retailer. The retailer must apply the request to the browser, device, and any profile it associates with that online activity. On the second visit, the same kind of signal arrives while the visitor is signed in. The signal still begins as a browser/device event, but the retailer now has a lawful operational connection to the account it knows. The distinction is not that one visitor made a “real” request and the other did not. Both made a valid request within the scope California recognizes. The difference is how much of the retailer’s information environment the business can connect to the choice at that moment.
That connection should not be confused with a power to resolve identity indefinitely. A pseudonymous profile can be covered because the business already uses it as an associated profile; the rule does not require the profile to be converted into a legal name. Conversely, the existence of a name in some unrelated database does not by itself show that the business can apply the signal to that record. The practical question is whether the receiving business knows the connection and can effectuate the sale/sharing opt-out for the relevant information. This is why a privacy signal can protect an online surface without becoming a universal identity key.
The same logic explains why the business must describe its handling in the privacy policy. A consumer needs to know whether the signal will operate only at the browser or device level, whether a logged-in account will also be covered, and whether the business has a way to apply the choice to offline sale or sharing. Those are not interchangeable promises. A business that can apply the signal only to online browsing information cannot describe the result as though it also covered unrelated offline records. The disclosure makes the boundary visible before the consumer has to decide whether an optional identity extension is useful.
California also limits how the business may ask for more information. The business may not require the consumer to provide information beyond what is necessary to send the signal. It may offer an option to provide identifying information if that would help apply the request to offline sale or sharing, but the consumer’s refusal does not cancel the browser/device-level request. Any information supplied for sending or processing the opt-out may not be used, disclosed, or retained for another purpose. The same purpose limitation applies to the platform or technology that sends the signal.
This is a careful compromise between reach and data minimization. A business may need an identifier to connect an online choice to a separate offline record. The regulation allows an optional path for that extension rather than pretending that a browser identifier can solve an identity problem it does not contain. At the same time, the business cannot convert the optional path into a toll gate: “Tell us who you are before we honor the signal.” The minimum request must be processed with the minimum information that makes it possible.
The business’s public explanation must reflect these distinctions. California requires the privacy policy to explain how the business processes opt-out preference signals, including whether a signal applies to the device, browser, consumer account, and/or offline sales, and in what circumstances. That disclosure is not a promise that every signal reaches every layer. It is an explanation of the scope the business has chosen and can operationalize under the rule.
Finally, California’s signal is not a general-purpose privacy command. The regulations separately define requests to delete, correct, access, limit the use of sensitive personal information, and opt out of automated decisionmaking technology. The opt-out preference signal provisions concern sale and sharing. A business cannot read the word “opt-out” and silently convert a signal about third-party sale or sharing into a deletion request or a sensitive-information limitation. A broader right may require a different request method or a different legal condition.
California’s answer is therefore both stronger and narrower than the everyday phrase “browser privacy signal” suggests. Stronger, because a qualifying signal is a valid sale/sharing request even when it arrives without a form or a name. Narrower, because the request begins with a defined purpose and a defined observable scope. The law does not ask the browser to prove an identity it does not know; it asks the business to honor the choice at the browser/device and associated-profile level, then extend it when a genuine connection supports extension.
That precise baseline makes the comparison with Colorado useful. The two regimes can use similar machine-readable formats, but Colorado adds a different question: how did the consumer choose to activate the mechanism, and which opt-out purposes did that choice communicate? California shows how a signal becomes a request through meaning and scope. Colorado shows why the origin of the choice can matter just as much as the message itself.