From Detection to Durable Opt-Out

Once California or Colorado recognizes a browser or device signal as a valid opt-out request, the difficult work begins. This chapter follows that request through the receiving business or controller: first determining its purpose and scope, then changing the relevant processing state, carrying the choice to other organizations, showing that it was honored, and handling any later attempt to reverse it. The point is to see legal force as a lifecycle rather than as a successful network lookup.

A request can fail at several transitions even when the original signal was valid. The recipient might apply it only to a browser while knowing that it belongs to an account, allow a local setting to override it, stop a current transfer but fail to tell a downstream recipient, or treat a later visit without the signal as consent. The California and Colorado rules address these transition points in different language, but both make the same larger idea visible: an opt-out is a state that must be maintained and operationalized.

The first moments after a valid signal

The first state is receipt. A business or controller detects a signal and determines what legal purpose it communicates. In California, the qualifying signal is a sale/sharing opt-out. In Colorado, a UOOM may communicate an opt-out from targeted advertising, the sale of personal data, or both. That purpose determines which processing state must change. A recipient cannot treat the signal as a general command to shut down every use of personal information, but it also cannot narrow a clear purpose merely because its internal settings are organized differently.

The next state is scope. California requires the business to apply a compliant signal to the browser or device and any associated consumer profile, including a pseudonymous profile. If the consumer is known, the request also applies to the consumer. Colorado similarly requires the controller, under the supplied rules, to apply the selected opt-out to the associated browser or device and, if known, the consumer. The request therefore enters the system with a scope that may be wider than a single HTTP transaction but narrower than every record the organization possesses.

At this point, local settings can create a conflict. California expressly says that a signal conflicting with a business-specific setting that allows sale or sharing must still be processed as a valid opt-out. The business may tell the consumer that the signal differs from the existing setting and offer an opportunity to consent, but the signal is not discarded merely because the older setting says yes. If the consumer gives the required consent, the business may ignore the signal for as long as the consumer is known, while displaying the status of the choice. The sequence matters: the signal changes the state first; a later affirmative action can change it again.

Financial-incentive programs create a narrower variation. If honoring the signal would withdraw a known consumer from a program that depends on consent to sale or sharing, the business may explain that consequence and ask the consumer to affirm the intention to leave.