Key Takeaways
- California's Opt Me Out Act, AB 566, takes effect January 1, 2027 and requires web browsers to include a setting that sends an opt-out preference signal to every site a consumer visits.
- A Piwik PRO and Verified Data scan of 59 major US hospital and clinic websites found 73% running advertising or marketing trackers while the Global Privacy Control signal was enabled.
- The same scan counted 75 unique tracking tools across those 59 sites, and 69% of the sites were using marketing or advertising cookies.
- California's $2.75 million Disney settlement faulted the company for applying Global Privacy Control only to a single device, even when the consumer was logged in to their account.
For most marketers, the Global Privacy Control has been an edge case: a signal sent by a handful of privacy-focused browsers and extensions, honoured or not depending on how a consent tool was configured. That changes in eleven weeks. From January 1, California law moves the opt-out from a niche add-on into the browser itself, and the evidence on how sites handle the signal today suggests a large share of tracking stacks will keep firing for visitors who have explicitly said no.
What Changes on January 1
Governor Newsom signed AB 566, the California Opt Me Out Act, on October 8, 2025, as the IAPP reported. It amends the CCPA so that companies that develop or maintain a web browser must build in an opt-out preference signal and explain to consumers how it works. The idea is to let people opt out of the sale and sharing of their data once, in the browser, rather than site by site. The California Privacy Protection Agency can adopt regulations to implement it, and the law gives browser makers liability protection when a website receives the signal and fails to honour it.
That last clause is the one marketers should read twice. It places the responsibility squarely on the site. As McDonald Hopkins points out, California already requires businesses to honour Global Privacy Control signals; what AB 566 does is put the switch in front of a far larger audience. The firm's advice for businesses that sell or share personal information is to make sure they can recognise these signals, update disclosures to match, and regularly test that opt-outs actually work.
Not everyone thinks this will be simple. Agency executive director Tom Kemp described the law to the IAPP as making privacy rights as simple as "clicking a button in your browser," while Loeb & Loeb's Jessica Lee cautioned that "there is no easy button for opt-outs."
Of 59 scanned US hospital and clinic websites had advertising or marketing trackers running while the Global Privacy Control signal was enabled.
How Sites Handle the Signal Today
The clearest recent measurement comes from healthcare, where the stakes are highest. In a study released July 2, 2026, Piwik PRO and Verified Data scanned 59 major US hospital and clinic websites and found that 73% had advertising or marketing trackers running despite visitors enabling the Global Privacy Control. Some 69% were using marketing or advertising cookies, and the researchers identified 75 unique tracking tools across the sample. The release also notes that healthcare organisations paid more than $100 million in HIPAA-related settlements between 2023 and 2025.
There are limits worth stating. Piwik PRO sells analytics software, the sample is small, and the scan looked at the presence and behaviour of scripts, cookies, pixels, and consent systems rather than testing whether protected health information actually reached a third party. But the pattern it describes is not unique to hospitals. The HIPAA Journal's coverage lists the tools involved: Google Analytics, the Meta Pixel, Microsoft Advertising, and session replay technologies, the same stack found on most commercial websites. Piwik PRO's Magdalena Pawlitko put the cause plainly: "Healthcare organizations often inherit their analytics setup rather than actively choose it."
That is the real problem the January deadline exposes. A consent banner can be configured correctly while a tag added by an agency two years ago, or a script loaded by another script, ignores it entirely. Verified Data founder Brian Clifton framed it the same way in the release: "This isn't a story about reckless marketers or bad intentions."
Civil penalty in California's Disney settlement, which faulted opt-outs that stopped at one device or one service instead of covering the whole account.
The Disney Standard: One Signal, the Whole Relationship
Honouring the signal on the page that receives it is not the bar California is enforcing. On February 11, 2026, the California Attorney General announced a $2.75 million settlement with Disney. Investigators found that Disney's opt-out toggles applied only to the streaming service being used, often only to the device in use, and that Global Privacy Control requests were limited to that device even when the consumer was logged in to their account. Disney's webform stopped sharing through its own advertising platform but not with certain third-party ad-tech companies whose code was embedded in its websites and apps.
Read against AB 566, that settlement sets out what compliance will mean next year. A browser signal from a known customer has to reach every system that sells or shares that customer's data, across devices and services, and it has to stop the embedded third-party code, not just the brand's own platform. For most organisations, that is an identity and data-routing problem rather than a banner configuration problem. As Attorney General Rob Bonta put it, "Consumers shouldn't have to go to infinity and beyond to assert their privacy rights."
- Test with the signal switched on. Load key pages with Global Privacy Control enabled and record which tags still fire; the hospital scan shows a working banner is no guarantee the scripts comply.
- Inventory every script, including inherited ones. Agency tags, session replay, and scripts loaded by other scripts are where opt-outs most often fail to reach, and where the embedded ad tech in the Disney case sat.
- Carry the opt-out to the account, not the device. When a signed-in customer sends the signal, the opt-out needs to follow them to every device and service tied to their profile.
- Route data through one controlled layer. Sending events server-side through a governed customer data layer makes it possible to enforce a single opt-out state, instead of trusting dozens of vendor tags to behave the same way.
- Model the measurement gap now. Once the setting ships in mainstream browsers, a share of visitors will drop out of ad-platform audiences and attribution, so budget and reporting baselines need adjusting before January.
- Lean harder on consented owned channels. Email, SMS, and messaging lists built on explicit opt-ins do not depend on third-party tracking, and they become more valuable as browser-level opt-outs spread.
The Opt Me Out Act does not create a new obligation for websites so much as remove the excuse that few visitors ever sent the signal. On January 1 the switch moves into the browser, the liability stays with the site, and California has already shown, in the Disney case, that it expects an opt-out to travel with the customer. The tracking stacks that pass that test will be the ones audited in the next eleven weeks, not the ones that wait for the first demand letter.
