This was a rulemaking week in California and a data-security week in New York, with an election result that changes the outlook for federal oversight. Here's what mattered.
Guidance and Rulemaking
The California Privacy Protection Agency's board voted unanimously to begin formal rulemaking↗ on amendments to the CCPA regulations on opt-out preference signals, IAPP reports, after taking up the package at its meeting scheduled for November 5-6. The proposal will be published in the California Regulatory Notice Register and open an initial 45-day comment period, with a 15-day period for each later round of modifications.
Covington's summary of the staff proposal↗ shows what businesses would have to do. Global Privacy Control would be named as an example of a signal that must be honored as a valid opt-out request, and browser or device features acting for a consumer couldn't prevent, interfere with, or disable the signal. The draft adds illustrative examples: a business receiving a signal must stop third-party trackers on its site from cookie syncing for cross-context behavioral advertising; a business that links devices into a pseudonymous profile, such as through fingerprinting, must apply a signal from one device to all linked devices; and a business must check for the signal before any cookies or pixels that sell or share personal information activate, because GPC arrives with the browser's first request. The proposal would also extend annual metrics reporting from businesses handling the data of 10 million or more consumers to any business required to complete a cybersecurity audit or risk assessment, and would add separate reporting of opt-outs received through a signal. Separate staff recommendations on reducing friction in exercising privacy rights and on notices and disclosures may move on different tracks. The Opt Me Out Act, which requires browser developers to offer GPC functionality, is scheduled to take effect January 1, 2027. For any business running consent or tag-management tools, the examples on pixels and cookie syncing are the part to test against now.
Elsewhere, the EDPB launched "Privacy for Kids,"↗ a hub of games, videos, and quizzes from data protection authorities across Europe for parents, teachers, and educators, filterable by age group, country, and topic.
Enforcement
New York Attorney General Letitia James, with the attorneys general of Connecticut, Michigan, and New Jersey, secured up to $10 million↗ from the Perry Johnson companies, including medical transcription and coding provider Perry Johnson & Associates, over a March 2023 breach affecting 13.3 million people, about 4.2 million of them New Yorkers. The headline figure is less than it sounds: the companies pay at least $300,000 in penalties, with $9.7 million due only if they fail to meet the agreement's terms, and New York receives at least $100,000. According to the investigation, hackers got in with a Coding employee's credentials at a time when the company didn't require multi-factor authentication for remote access, then spent months harvesting passwords and accessing unencrypted files holding names, Social Security numbers, diagnoses, insurance details, and lab and medication information. The company's software recorded the activity but wasn't configured to alert security staff, and the company learned of the breach only when the hackers contacted it two months later. The settlement requires an information security program and incident response protocol, multi-factor authentication, password management, encryption and asset management, annual HIPAA-consistent risk assessments, and policies on the collection, use, retention, and disposal of health information. For vendors that hold other companies' data, the case is a checklist of basics: remote-access MFA, encryption, and alerts that someone actually receives.
Also worth noting
The midterm elections will shape oversight in 2027. IAPP reports that Democrats won both chambers of Congress, with some races still being counted, along with several governorships and attorney general seats. The piece notes that Rep. Frank Pallone, who is exploring personalized pricing, is in line to lead the House Energy and Commerce Committee, and that Texas voters elected a Democratic attorney general, leaving it unclear whether the privacy settlements reached under Ken Paxton will continue to be enforced. The analysis↗ also stresses that Democrats still need either President Trump's signature or a veto-proof majority to pass legislation, and the possible committee priorities it lists, such as federal privacy legislation, AI accountability, and children's online safety, are speculation, not announced plans.
The Takeaway
The common thread is that regulators are writing down exactly how privacy controls must work, and then checking whether they do. California's draft would turn GPC from a recognized signal into a detailed technical obligation, and New York's settlement spells out the security baseline a data processor is expected to have had all along. The practical to-do list is concrete: test whether your site checks for a GPC signal before firing any cookie or pixel that sells or shares data, confirm that signals apply across linked devices where you build cross-device profiles, verify that every remote-access path to personal or health data requires multi-factor authentication, and watch the 45-day California comment period once the notice is published.