How the APRA draft moved privacy compliance to the customer’s side of the counter

The week

On April 7, 2024, Senate Commerce Committee Chair Maria Cantwell and House Energy and Commerce Committee Chair Cathy McMorris Rodgers released a bipartisan discussion draft of the American Privacy Rights Act, or APRA. It was a plan that would have changed who holds the levers in American privacy law. For years that law had worked mostly behind the scenes: companies wrote policies, regulators examined them, and customers rarely saw any of it.

A discussion draft is a bill text published for comment before it is formally introduced. This one mattered because of who wrote it: the chairs of the two committees that would have to move any federal privacy law. It was the first serious federal attempt since the 2022 American Data Privacy and Protection Act stalled.

That 2022 bill, known as ADPPA, had cleared the House Energy and Commerce Committee with near unanimity in July 2022. It never reached a floor vote. Senator Cantwell had not backed it, and California’s delegation objected to how far it would have overridden the state’s own privacy law. The 2024 draft was built to answer both objections: it added a stronger right for individuals to sue, and it was pitched as a national standard that drew on the strongest state laws.

The draft also set out who would be covered. Small businesses with less than $40 million in annual revenue were largely exempt, provided they handled limited personal data and did not sell it. At the other end, “large data holders,” companies with more than $250 million in revenue that processed large volumes of data, faced extra transparency and reporting duties. Executives were made responsible for compliance, and the draft carried data security obligations alongside the privacy rules.

Like its predecessor, it centered on data minimization, the idea that organizations should collect and keep only the personal data they actually need. It also preempted most state comprehensive privacy laws, meaning one federal rule would have replaced the growing patchwork of state ones. Banks and health organizations got a carve-out. Entities complying with the Gramm-Leach-Bliley Act (GLBA, the main federal law on financial privacy) or HIPAA (its health care counterpart) would be deemed compliant for data covered by those laws.

The draft gave individuals rights to access, correct, delete and export their data. It required opt-outs for targeted advertising and data transfers. It called for a universal opt-out mechanism, to be defined by the Federal Trade Commission: a way for someone to say “no” once, through their browser or device, and have every site respect it. Data transfers to foreign adversaries would have to be disclosed. It also created a right to opt out of covered algorithms used for consequential decisions, such as those about credit, housing or health care.

Data brokers, the companies that buy, compile and sell information about people, would have to register with the FTC and honor a central do-not-collect request. The draft gave brokers 30 days to act on opt-outs. Enforcement would have run on three tracks at once: the FTC, state attorneys general and individuals. Individuals could sue directly, with arbitration clauses unable to block certain claims. Before seeking a court order, a plaintiff generally had to give the company notice and a 60-day window to fix the problem, except where the harm was substantial.

The draft moved privacy compliance from the back office to the customer’s side of the counter.

The committees moved fast. On April 17, the House Energy and Commerce subcommittee on innovation, data and commerce held a legislative hearing that took up the draft alongside a set of children’s online safety bills. Business groups welcomed the idea of one national rule but objected to the lawsuit provisions. Some privacy advocates welcomed the rights but objected to overriding stronger state laws. Both reactions previewed the fault lines that would decide the bill’s fate within three months.

For compliance leaders at banks and health systems, the first reading was mostly about the carve-out. The draft promised not to disturb GLBA and HIPAA programs. A closer reading showed how much of their customer data lay outside those programs, and how directly customers could test it.

The 2024 draft kept the 2022 bill’s data minimization rule, a design rule applied to data rather than to whole regulated institutions, and kept its carve-out structure. What it changed was who would act on them.

Most American privacy compliance had been organized around regulators: policies, notices and audits written for an examiner or an attorney general. APRA added channels through which individuals could act directly and at scale. There were three of them. People could make requests, send signals that a website or app must honor, and bring lawsuits.

Each one tests a different part of an organization, and each one was arriving through state law whether or not Congress acted. That is why a bill that never passed is still worth a careful read.

The sections below take this in order. Two framing sections come first: how the audience for privacy work changes when customers can act, and how the draft’s structure decided whose data, and whose organization, was in scope. The three channels follow, one section each. The last sections turn to what the channels mean for budgets and for the operating model.

From examiners to customers

Consider how privacy compliance has usually worked at a bank or a hospital. A privacy team writes a policy. Lawyers draft a notice that few people read. Every so often an examiner or auditor checks that the policy exists and is followed. The audience for all of this work is a professional reviewer who visits occasionally and reads carefully.

APRA imagined a different audience: millions of ordinary people, each able to act on their own. That is a very different test. An examiner reviews a sample. Customers test every path, at every hour, through every channel. An examiner tolerates a remediation plan. A customer whose request is ignored just gets annoyed, complains publicly, or calls a lawyer.

The difference resembles that between a fire inspection and an actual fire. The inspection checks that the exits are marked and the extinguishers are charged. The fire tests whether people can really get out. Customer-driven privacy rights are much closer to the fire drill that happens every day.

This changes who owns the problem. When privacy is about policies, it sits with legal and compliance. When it is about requests, signals and lawsuits, it also sits with the people who run customer service, the website, the mobile app, marketing and data engineering. That is a bigger group, and it needs someone to coordinate it.

Who owns a customer-facing privacy channel

A program built for examiners usually has one owner, the chief privacy officer or the compliance function. A program built for customers needs a clearer split. Privacy counsel interprets what the law requires. An operations lead, often in customer service, runs the intake and the clock. Data engineering maintains the map of where personal data lives. Marketing and the web team own the tags and the consent tools. Information security owns identity verification.

Each of those groups already has its own priorities and budget. Without a named coordinator with authority across them, requests stall at the handoffs. The most useful single control is a weekly operating review, with the request backlog, signal test results and complaints on one page, attended by all five owners.

How the shift lands by type of organization

The burden falls differently across regulated organizations. A credit union with a small staff runs most of its customer data through a core processor, a digital banking vendor and a marketing platform. Its request process depends on what those vendors can search and export, so the contracts matter as much as the policy.

A broker-dealer has the opposite problem. SEC Rule 17a-4 requires it to preserve many records for years, under conditions that protect them from alteration or deletion. A deletion request cannot override that duty, and comprehensive privacy laws generally let organizations keep data they are legally required to retain. The hard part is explaining that to a customer in a way that does not read as a refusal.

A health system has scale and fragmentation. It may operate hospitals, physician practices, a foundation, a health plan and a research arm, each with its own systems. Patients see one brand. The request process has to make that brand behave as one organization, even when the underlying entities are legally distinct.

Public agencies were largely outside the draft, and most state comprehensive privacy laws exempt government bodies too. Agencies still meet the same channels through their contractors, who may be covered, and through their own public records and privacy statutes. A state benefits agency that runs its portal through a vendor inherits that vendor’s tag configurations and its data practices.

The architecture of the draft: one national rule, with sector carve-outs

Two structural features of APRA shaped everything else, and both are worth understanding even though the bill did not pass.

Preemption

Preemption is the legal principle that a federal law can override state laws on the same subject. By 2024 a growing number of states had passed their own comprehensive privacy laws, each with slightly different definitions, deadlines and rights. A company operating nationally had to track each of them. APRA proposed to replace most of those state laws with one federal standard. For businesses, that was the main attraction. For some states and advocates, it was the main objection, because it could have lowered protections in states that had gone further.

The sector carve-out

Banks and health care organizations already live under federal privacy laws written for their industries. GLBA governs how financial institutions handle customers’ financial information. HIPAA governs how health plans, providers and their contractors handle health information. APRA did not try to rewrite those rules. Instead, an organization complying with them would be deemed compliant for the data those laws cover.

That sounds tidy, and in a legal sense it is. In practice it creates a seam. A modern bank or hospital holds a great deal of personal data that is not, strictly speaking, an account record or a medical record. Website visits, app usage, event registrations, marketing preferences and survey answers can all fall outside the sector law. The carve-out protected the core. It left the edges exposed, and the edges are where customers increasingly interact with an organization.

Entity-level and data-level carve-outs

Carve-outs come in two forms, and the difference decides how much work an organization faces. An entity-level exemption removes a whole organization from a law because it is regulated under GLBA or HIPAA. A data-level exemption removes only the data those laws cover, leaving everything else in scope.

Most of the state laws passed after California’s used entity-level exemptions for GLBA financial institutions. California’s law took the data-level approach from the start, which is why California banks and credit unions run consumer request processes for their marketing and website data. APRA’s wording, deemed compliance for data covered by the sector laws, was closer to the data-level model.

For a bank, the practical question becomes which of its data GLBA actually governs. Account records clearly qualify. Data about prospects who never became customers, website visitors who never logged in and attendees at community events may not. For a hospital, HIPAA covers protected health information held by the covered entity, but marketing lists, donor records held by a separate foundation and general website analytics can fall outside it.

Nonprofit status adds another layer. California’s law applies to for-profit businesses, so many nonprofit hospitals fall outside it. Colorado’s law, by contrast, reaches nonprofits. A health system or credit union operating in several states can be outside one state’s law and inside another’s for the same activity.

The case for and against one national rule

Preemption had a strong business case. A national organization would build one request process, one consent model and one set of notices. Smaller organizations, which cannot afford a lawyer for every state, would gain the most.

The case against was also serious. A federal ceiling could freeze protections at the level of the compromise, and states that had gone further would lose their rules. Federal agencies also change direction with each administration, while state legislatures and attorneys general had shown they would keep acting. The June revisions narrowed preemption to win support, which showed how hard the trade-off was to settle.

Data minimization runs underneath both features. Its logic is simple: data you never collected cannot be breached, requested, sold or subpoenaed. Each of the three customer channels below becomes cheaper to run when there is less data to find, delete or explain.

Requests: people asking for their data

Access, correction, deletion and export rights were familiar from California and the states that followed. A federal baseline would have made them universal. For banks and health systems, the carve-out shaped what customers would actually experience. Account records under GLBA and medical records under HIPAA would follow those laws. Website analytics, marketing lists, event sign-ups and app data might fall under the new act. A customer who asks a bank for “my data” does not know or care which statute governs which table.

That makes the request front door a design problem. A single intake, through the app, the website and the branch or front desk, should verify identity, log the request and route it to every system that holds the person’s data. In a large organization that can mean dozens of systems: the core account platform, the customer relationship database, the marketing email tool, the analytics service, the call center recordings and more.

Identity verification is the hardest step. An access request is also an account takeover route: a fraudster who passes a weak check receives a complete profile. Account takeover is when a criminal gains control of someone else’s account, often by pretending to be them. A privacy request is an attractive way to do that, because it asks the organization to hand over everything it knows. Requests should therefore use the same strength of verification as the channel’s other high-risk transactions, such as changing a phone number or adding a new payee.

The response should be one readable package, with a plain explanation where some data falls under a sector law and is handled differently. The service metrics are the ordinary ones for any customer channel: time to complete, rework rate and complaints.

The mechanics of a single request

A well-run request moves through about eight steps. Intake captures the request from any channel and starts the clock. Verification confirms who is asking, or that an authorized agent has the person’s permission. State laws such as California’s allow people to use agents, and some services file requests in bulk on consumers’ behalf.

Scoping then decides what kind of request it is: access, correction, deletion, export or opt-out. Discovery searches every system on the data map. Review applies exceptions, such as legal retention duties, litigation holds and information that would expose another person. Assembly builds the response. Delivery sends it securely, never as an open email attachment. Closure records what was done and when.

Each step has a typical failure. Intake loses requests that arrive by letter at a branch. Verification is either too weak, inviting fraud, or so strict that genuine customers give up. Discovery misses systems added after the data map was last updated. Review applies exceptions inconsistently between staff.

Where requests collide with other duties

Regulated organizations face conflicts that a retailer does not. A bank’s anti-money-laundering records must generally be kept for five years under the Bank Secrecy Act. Suspicious activity reports are confidential by law, so an access request must never reveal that one exists. Staff handling privacy requests need a hard rule that such material is out of scope and is never mentioned in a response.

Health organizations run two access regimes side by side. HIPAA gives patients a right to their designated record set, generally within 30 days, with one 30-day extension. State privacy laws set their own deadlines, California’s being 45 days with a possible extension. A single patient request may touch both, and the team needs to know which clock applies to which part.

Deletion is the hardest right for regulated firms to honor. Most of what a bank or hospital holds about a customer or patient must be kept. A good response says plainly what was deleted, what was kept, and the general reason for keeping it. Customers accept retention far more readily when it is explained than when it is discovered.

Data broker provisions added a further demand. A central do-not-collect request would have reached every registered broker at once, so organizations that buy marketing or identity data would see their sources change. A bank that buys lists of likely customers, or a health system that uses third-party data to check addresses, would find that some records simply disappear from what it receives.

Suppose a customer of a regional bank asks, through the bank’s app, for “everything you have on me.” The bank pulls account records from its core system without trouble. But the customer also attended a home-buying seminar, signed up for a newsletter and used the bank’s mortgage calculator online. Those records sit in three different tools owned by three different teams. If the bank answers with account records alone, the customer sees an incomplete picture, and anyone checking later sees a gap.

The fix is unglamorous. The bank lists every tool that touches customer data, including the ones bought by marketing on a corporate card. Each tool gets a named owner and a documented way to search and export a person’s records. New tools cannot go live until they are on the map. That last rule does more for request quality than any request-tracking software.

Signals: opt-outs sent by software

The second channel needs no human request at all. A universal opt-out mechanism is a signal sent by a browser or device, telling every site it visits that the person opts out of targeted advertising and data sales or transfers. Instead of clicking “do not sell” on every website, the person sets a preference once, and their browser announces it automatically on each visit.

Several states already required businesses to honor such signals. Colorado’s requirement took effect in July 2024.

How a signal travels

The best-known signal is Global Privacy Control, developed in 2020 by researchers and privacy-focused companies. A browser or extension that supports it adds a simple header, Sec-GPC: 1, to every web request. It also exposes the same preference to the page’s own scripts. California’s attorney general had already shown the signal had teeth: in August 2022, Sephora paid $1.2 million in a settlement that included its failure to process opt-outs sent this way.

Honoring the header takes a chain of software working in order. The consent management platform must read the header before any advertising code loads. It must translate the signal into the same opt-out state as a click on the website’s banner. The tag manager must check that state before firing each tag. Server-side data feeds, which send events from the organization’s own servers to advertising platforms, must check it too.

Two gaps are common. First, a browser signal identifies a browser, not a person. When a customer logs in, the better practice is to attach the opt-out to the account, so it follows the customer to the app and to other devices. Second, mobile apps do not receive browser signals at all, so an organization needs an equivalent setting inside the app.

Signals test the plumbing behind a website. Most organizational websites carry small pieces of code from outside companies, often called tags or pixels, that report what visitors do to advertising and analytics services. A tag manager is the control panel that decides which of those pieces of code run on each page. Honoring a signal means the tag manager must suppress advertising pixels and third-party scripts for that visitor, consent records must store the signal, and downstream data feeds must exclude the person.

For health systems, whose public websites have drawn regulatory attention for tracking technologies, the signal and the tracking question meet in the same code. A signal that is recorded but not enforced in the tags is worse than none, because it creates a record of a promise not kept.

The health regulators had already moved. In December 2022, the HHS Office for Civil Rights issued a bulletin warning that tracking technologies on hospital websites and apps could disclose protected health information to vendors without permission. In February 2023, the FTC brought its first enforcement action under its Health Breach Notification Rule against GoodRx, over health data shared with advertising platforms, with a $1.5 million civil penalty. By April 2024, hospital marketing teams had already been asked to remove or reconfigure many tags.

For banks, the regulatory hook was different but the plumbing was the same. A credit union’s public website carries the same kinds of analytics and advertising code as a retailer’s. Under the data-level reading of the carve-out, website visitors who are not members are outside GLBA entirely.

That last point surprises many executives. Capturing the preference is the smaller part of the work. A log showing that a visitor said “no” while the advertising code went on firing is close to the most damaging document an organization could hold, because it proves the organization knew.

The algorithm opt-out was the more unusual signal. A covered algorithm, in this sense, is a computer process that makes or helps make a decision about a person. The draft would have let a person decline one used to make or facilitate a consequential decision, such as credit, housing or access to health care.

For a lender or a benefits-adjacent health program, that implies an alternative process with human review, and the capacity to run it. If many applicants opt out at once, an automated decision flow turns into a manual queue. The design question is how to staff that queue and how long applicants wait. A loan decision that takes seconds by machine might take days by hand, and an applicant who opted out should not be penalized with a worse experience.

Lenders were not starting from zero. The Equal Credit Opportunity Act and Regulation B already require creditors to give applicants specific reasons when they deny credit. In May 2022, the Consumer Financial Protection Bureau said in a circular that this duty applies even when a complex algorithm makes the decision. A lender that can explain an automated denial has done much of the documentation work that a human-review alternative needs.

Health organizations face a different version. Algorithms increasingly help decide care management outreach, scheduling priority and, at health plans, coverage reviews. An opt-out right would require a plan or provider to know which of these tools count as making or facilitating a consequential decision. Few had a complete inventory of them in 2024.

The workable approach is an algorithm register. It lists each automated tool that affects a decision about a person, the decision it informs, the owner, the human fallback and the expected volume if people opt out. The same register serves model risk management at banks and the governance that health systems were already building for clinical decision support.

Suits: individuals as enforcers

The third channel was the most contested. The draft let individuals sue for many violations without first waiting for a regulator. Lawyers call this a private right of action. It made pre-dispute arbitration agreements unenforceable for claims involving substantial privacy harm or minors. An arbitration clause is the fine print in many customer agreements that sends disputes to a private arbitrator instead of a court, and often rules out class actions. Financial institutions rely heavily on arbitration clauses, so this was a material shift in exposure.

Litigation changes what counts as evidence. Privacy notices, consent screens, tag configurations and request logs become exhibits. A delay in honoring an opt-out, or a pixel that fired after a signal, is no longer a finding to remediate in private. It can become a claim. Regulated organizations already saw this pattern in suits under state wiretap and video privacy laws over website tracking.

The litigation that was already under way

Private privacy litigation did not wait for a federal law. Plaintiffs had been using the California Invasion of Privacy Act, a wiretap statute written decades before the web, to argue that third-party tracking code on a website eavesdrops on visitors. They used the federal Video Privacy Protection Act, a 1988 law, against sites that shared video viewing data through pixels. Illinois’ Biometric Information Privacy Act allows statutory damages of $1,000 or $5,000 per violation, which turned technical lapses into very large claims.

Washington’s My Health My Data Act, which took effect for most entities in March 2024, added a private right of action for consumer health data held outside HIPAA. That covers exactly the health-adjacent data at the edges of a hospital’s or insurer’s operation: app data, location near clinics and wellness programs.

The pattern in these cases is consistent. The claims rest on what the organization’s own systems did, as shown by its own configurations and logs. The defense rests on whether the organization can show it knew what its code was doing and had controls on it.

Take a community hospital whose website carries an analytics tag that the marketing team added years ago to measure campaign results. Nobody in compliance knew it was there. A patient visits the page for a sensitive service, with an opt-out signal switched on in their browser. The tag fires anyway and sends details of the visit to an outside company. Under a regulator-led model, that might surface in an audit and be fixed. Under a model where individuals can sue, the same facts become a complaint, with the hospital’s own tag settings and logs as the main evidence. The fix is identical in both cases. The cost of discovering the problem late is not.

The strongest case against private enforcement

Critics of a private right of action made a serious argument. Lawsuits can be driven by statutory damages rather than by harm, and settlements can reward technical violations while doing little for the people affected. The House majority leader at the time, Steve Scalise, flagged the private right of action as a point of contention, and it remained one after the June revisions.

The draft’s 60-day notice window for most claims seeking a court order was an attempt to answer that critique. It gave organizations a chance to fix problems before a suit could proceed, except where the harm was substantial. A right to cure rewards organizations that can find and fix a problem within weeks. It does little for one that needs a quarter to locate the code involved.

The argument of this article does not depend on the private right surviving. Attorneys general and the FTC use the same evidence: notices, consent records, tag settings and request logs. An organization whose systems do what its notices promise is in a better position under any enforcement model.

Arbitration matters here because it changes the scale of the risk. A single customer dispute handled privately is manageable. Many customers joining one court case over the same practice is a very different exposure, and the draft would have opened that door for the most serious privacy claims.

The three channels are connected. A person whose request goes unanswered, or whose signal is ignored, has a reason to sue. Organizations that run requests and signals well reduce the third channel’s risk at its source.

Predictable costs against unpredictable claims

The investment case follows. Spending on request handling and tag enforcement is a predictable operating cost, while claims are not. A board can budget for a well-run request service. It cannot budget for a class action built on records showing that opt-outs were ignored.

The same spending also improves the customer experience that requests and signals measure, which gives it a sponsor outside compliance. A customer who gets a clear, complete answer to a data request quickly is a customer who trusts the organization a little more. A website that honors preferences without fuss is one that marketing can defend in public.

There is a regulatory angle too. Supervisors in banking and health care increasingly look at how organizations treat customers as well as whether policies exist. Request backlogs, complaint patterns and tracking incidents are the kind of evidence that turns a privacy issue into a conduct issue. Organizations should check with counsel on which state laws and private rights of action apply to them.

What the work costs, and who pays

The costs fall into a few buckets. Request handling needs a case management tool, connectors to the main systems and trained staff. Signal enforcement needs a consent platform, tag governance and regular automated testing. The data map needs an owner and a refresh cycle tied to procurement, so new tools are added before they go live.

The trade-offs land mostly on marketing. Suppressing tags for visitors who opt out reduces the data available for advertising measurement. Some campaigns will look less effective on paper. The honest framing for a marketing leader is that the lost data was never lawfully available for those visitors, and that the organization is now measuring its real audience.

Vendors carry part of the load. Service provider contracts should require vendors to search, export and delete a person’s data on request, within a set time, and to honor opt-out states passed to them. Smaller organizations, such as community banks, credit unions and rural hospitals, often depend on a few large vendors. They gain most by negotiating these terms collectively, through user groups or shared service organizations, rather than one by one.

The investment also has a sequence. Signal enforcement is usually the fastest win, because a small number of tag and consent changes fixes a large share of exposure. The request front door comes next. The algorithm register and the human fallback take longest, because they depend on business owners agreeing what each tool decides.

One front door, and tags that obey

The pieces of a working program are recognizable:

• One front door. Every request, from every channel, enters one process with one log, one owner and one clock.
• A data map that is kept current. The organization knows which systems hold personal data, so requests reach all of them.
• Verification matched to risk. Requests get the same identity checks as other sensitive changes, not a weaker one because “it’s just privacy.”
• Signals enforced in the code. Regular testing shows that tags actually stop firing when a signal is present.
• A staffed human alternative. Where automated decisions are involved, the manual path exists, has capacity and is measured.
• Evidence kept with care. Logs, consent records and tag settings are retained and changes are controlled, because they may be read in court.

The failures mirror these. Some organizations treat requests as a legal inbox rather than a customer service. Some answer from the main system only and miss the marketing and analytics tools. Some capture opt-out signals in a database but never connect them to the tags. Some assume the sector carve-out covers everything, when much of their customer data actually lies outside it.

The evidence an examiner or plaintiff would ask for

A program that works should be able to produce a short evidence file on demand:

• Request records. Volumes by type and channel, median and longest time to complete, and the share reopened after a complaint.
• Verification records. The checks applied to each request type, and any requests rejected or escalated as suspected fraud.
• Signal test results. Dated tests showing which tags fired with and without an opt-out signal, on the main pages and the portal.
• Change history. Who added or changed each tag, when, and who approved it.
• Vendor terms. The contract clauses that require each vendor to support requests and opt-outs.

Each of these records is cheap to keep when it is designed in from the start, and costly to rebuild after a complaint or a subpoena.

Where privacy rights meet the front line

1. If a customer asks for all the data we hold on them today, how many systems would we need to search, and do we know what they are?
2. How do we verify identity on a privacy request, and is it as strong as our check for changing a customer’s contact details?
3. When a visitor’s browser sends an opt-out signal, what actually changes on our website? Has anyone tested it recently?
4. Do we use automated tools to make or support decisions about credit, housing or care? If customers could opt out, who would do the work instead, and how long would it take?
5. If a plaintiff’s lawyer asked for our request logs and tag configurations, would we be comfortable with what they showed?

With hindsight

APRA did not pass. A revised draft followed in late May, after a House subcommittee advanced the bill. It was formally introduced as H.R. 8818 on June 25. A June 20 version dropped the civil rights and algorithm provisions, and the House Energy and Commerce markup set for June 27, 2024, was canceled minutes before it began. A markup is the committee session where lawmakers debate and amend a bill before sending it on, so canceling it at the last minute effectively stalled the effort. The bill expired with the 118th Congress, and no comprehensive federal consumer privacy law has been enacted since.

The three channels kept arriving through the states. Colorado’s universal opt-out requirement took effect in July 2024, and more states required businesses to honor such signals. California’s Delete Request and Opt-out Platform, a single deletion request reaching every registered data broker, opened to consumers in January 2026, with brokers required to process requests from August 2026. California also finalized rules on automated decision-making technology in 2025. Private litigation over website tracking continued.

Enforcement made the signal channel concrete. In June 2024, a federal court in Texas, ruling in a suit brought by the American Hospital Association, vacated part of the HHS tracking bulletin as it applied to some public web pages. That narrowed the federal hook for health websites but left state privacy law intact. In July 2025, California’s attorney general announced a $1.55 million settlement with the health information publisher Healthline. The state alleged that the site failed to honor opt-outs from targeted advertising, and that it shared data, including article titles, suggesting a reader might have a particular medical condition.

In September 2025, the attorneys general of California, Colorado and Connecticut announced a joint sweep. They sent letters to businesses that did not appear to be honoring Global Privacy Control signals. In February 2026, California announced a $2.75 million settlement with Disney over opt-outs that were not applied across all the devices and services linked to a customer’s account. That case confirmed the point about logged-in customers made above.

The signal itself is becoming standard equipment. Connecticut began requiring businesses to honor opt-out signals in January 2025, New Jersey in July 2025 and Oregon in January 2026. California went further, requiring web browsers themselves to offer consumers an opt-out preference signal setting from January 2027. Once mainstream browsers ship that setting, the share of visitors sending a signal to bank and hospital websites is likely to rise sharply.

On automated decisions, California’s privacy agency saw its regulations on automated decision-making technology, risk assessments and cybersecurity audits approved in September 2025, taking effect at the start of 2026. For data buyers, that platform is the clearest sign of the change. Its deletion platform now reaches more than 600 registered data brokers through a single request, with brokers checking it at least every 45 days.

The customer-facing operations APRA anticipated are now required by a growing patchwork, which is harder to run than the single federal standard would have been. Instead of one set of rules, organizations operating nationally must track different timelines, definitions and obligations state by state.

Waiting for Washington turned out to be the wrong bet. The work this draft pointed to, a single request front door, opt-out signals that really switch off tracking, a staffed alternative to automated decisions and carefully kept evidence, is needed anyway. Organizations that built it as a customer service, not a legal project, are better placed for whatever the next state, or eventually Congress, requires.

The patchwork also rewards the data minimization idea at the heart of the draft. Every record an organization does not hold is one it never has to find, delete or defend under any state’s rules.