California continues to aggressively expand consumer privacy rights. Under recent CPRA regulatory updates taking effect in 2026, the definition of “sensitive personal information” now explicitly includes neural data (data measuring central nervous system activity), and automatically classifies any data collected from minors under 16 as highly sensitive.
Furthermore, businesses can no longer rely on slow, overnight batch-processing for consumer opt-out requests. If a user signals they do not want their data sold or shared, whether through a website cookie banner or a universal browser signal like Global Privacy Control (GPC), your website must possess the technical architecture to process and honor that request in real-time.
You are also required to provide immediate confirmation to the user that their opt-out request has been successfully processed.
