Privacy Please: CPPA Announces Joint Consumer Data Opt-Out Investigation

On September 9, 2025, the California Privacy Protection Agency ("CPPA") announced a multi-state investigation into businesses that fail to honor consumer opt-out requests. As our readers are aware, the CPPA protects the privacy rights of Californians by implementing and enforcing the California Consumer Privacy Act ("CCPA"). The large-scale privacy investigation will be conducted with assistance of the Attorneys General of California, Colorado, and Connecticut.

What is the Focus of the Opt-Out Investigation?

Among other privacy protections, the CCPA requires that online businesses offer consumers two methods to opt out of the sale/sharing of their data:

1. Global Privacy Control ("GPC") – The GPC allows users to automatically signal to websites that they would like to opt-out of the "sale" and "sharing" of their personal information. This "stop selling or sharing switch" is available on some internet browsers, like Mozilla Firefox, or downloadable as a browser