Privacy Update: California Opt-Out Rules & EU Tracking Fines

Opt-Out Signals, Easy Opt-Outs, and Tracker Consent

Privacy regulators are paying closer attention to what happens after consumers share their data, reject tracking, or exercise their privacy rights.

Recent developments in California, across the US, and in Europe highlight three growing priorities: honoring automated privacy signals, preventing tracking without valid consent, and making privacy choices genuinely accessible.

For Shopify merchants, these developments are particularly relevant to advertising pixels, product recommendations, customer profiling, and the way online stores handle privacy requests.

TLDR

• CalPrivacy released proposed amendments that clarify how businesses must handle opt-out preference signals (OOPS), including Global Privacy Control (GPC). ‍
• California settled with Lyft for $1.8M over a buried, multi-step opt-out outside the app.‍
• France’s CNIL fined electronics retailer Fnac Darty €7M for a third-party app tracker used for product recommendations without valid consent, plus a €10,000/day penalty until it proves compliance.
• The FTC ordered major firms including Walmart and Target to explain how personal data shapes prices.
• For Shopify stores, the through-line is clear: honor browser opt-out signals early, put sale/share opt-outs where shoppers already are, and do not fire marketing or recommendation trackers before consent.

California Proposes Clearer Rules for Global Privacy Control (GPC)

The California Privacy Protection Agency (CalPrivacy) has released proposed amendments clarifying how businesses must respond to Opt-Out Preference Signals (OOPS), including Global Privacy Control (GPC).

GPC allows consumers to communicate their preference not to have their personal information sold or shared through their browser, without having to manually opt out on every website.

The proposed amendments would clarify several important requirements:

• Recognizing GPC signals: Explicitly identifying GPC as a valid opt-out preference signal.
• Blocking data sharing early: Clarifying that businesses must detect and honor applicable signals before advertising cookies or pixels begin selling or sharing personal information.
• Respecting preferences across devices: Applying opt-outs across linked consumer profiles when businesses associate multiple devices with the same individual.
• Improving reporting: Expanding privacy request metrics requirements for certain businesses, including separate reporting of opt-outs received through preference signals.

Importantly, CalPrivacy describes most of these changes as clarifications of existing obligations, not entirely new requirements.

The proposals are scheduled for discussion at the November 5–6, 2026, board meeting, where they may advance to formal rulemaking. They are not yet final.

What this means for Shopify merchants

An opt-out preference is not simply a banner setting. It must affect how personal information is actually sold or shared.

Many Shopify stores still load Meta, Google, TikTok, or recommendation scripts in the head, then ask a CMP to catch up. CalPrivacy’s draft language pushes the opposite order: detect the signal first, then decide what may load.

California settles with Lyft: opt-out cannot live three links deep

California Attorney General Rob Bonta announced a $1.8 million settlement with Lyft (Oct 29, 2026). The AG alleged that since mid-2023 Lyft sold or shared riders’ and drivers’ personal information for in-app targeted ads without an opt-out inside the app.

Instead, users had to:

1. Open the in-app privacy policy
2. Follow links to a web “Do Not Sell or Share” page
3. Log in again and submit more personal information

...even though Lyft already knew who they were.

The settlement requires Lyft to provide an in-app opt-out option and notify California consumers of their rights.

The lesson for Shopify stores

Privacy rights should be easy to find and exercise, not buried behind multiple pages, confusing links, or unnecessary verification steps.

Merchants should make sure customers can readily access their "Do Not Sell or Share My Personal Information" options where required.

France Fines Fnac Darty €7 Million for Tracking Shoppers Without Consent

France's data protection authority, the CNIL, imposed a €7 million fine on retailer Fnac Darty over tracking in its mobile application.

The regulator found that a third-party tracker collected users' browsing activity, including products they viewed, without obtaining the required consent.

That information was used to display personalized product recommendations and train a recommendation algorithm.

The CNIL concluded that the tracking was not strictly necessary to provide the service requested by users and therefore could not benefit from the applicable consent exemption.

The regulator also ordered the companies to demonstrate that their replacement tool obtains consent where required, with a potential €10,000 daily penalty for delays.

What this means for online stores

Product recommendations are standard in ecommerce, but the technology behind them matters.

A recommendation widget may rely on browsing history, third-party identifiers, behavioral profiling, or other tracking technologies. When these involve non-essential tracking, applicable consent requirements cannot be ignored simply because the feature improves the shopping experience.

For Shopify merchants, this is a reason to review recommendation apps, analytics integrations, and third-party scripts added to the storefront.

Consentmo offers two relevant tools:

• AI Tracker Manager helps identify cookies, pixels, scripts, and other trackers introduced by Shopify apps and integrations.
• Consent Monitoring tests live storefront tracking behavior before and after visitors make their consent choices, helping uncover technologies that may be activating when they should be blocked.

The CNIL case concerned a native mobile app, while these Consentmo tools focus on Shopify storefronts. The underlying lesson applies to both: the actual behavior of tracking technology matters more than the presence of a consent notice.

FTC Investigates How Companies Use Customer Data to Set Prices

Could two shoppers see different prices for the same product because of their browsing behavior or personal information?

That's one of the questions behind a new inquiry by the US Federal Trade Commission (FTC).

The FTC has ordered nine companies, including Walmart, Target, Instacart, Uber, and DoorDash, to provide information about how they use personal data to determine prices and, in some cases, worker compensation.

The investigation focuses on personalized pricing practices that may involve:

• Browsing history and online behavior
• Customer profiles and loyalty program participation
• Personal information used to estimate willingness to pay
• Algorithms that adjust prices for individual consumers

The FTC is gathering information to understand these practices. The inquiry does not establish that the companies have violated the law.

Why ecommerce merchants should pay attention

Personalization is already a major part of ecommerce. Stores use customer behavior to recommend products, segment audiences, deliver discounts, and improve conversion rates.

However, personalized recommendations and personalized pricing are not the same thing.

Using browsing data to suggest relevant products differs from using that data to calculate how much a particular shopper might be willing to pay.

For merchants experimenting with AI-powered pricing, dynamic discounts, or behavioral profiling, the investigation reinforces the importance of understanding which personal information powers these systems and whether consumers are being misled about pricing practices.

Practical checklist for Shopify merchants this week

Here are four areas worth reviewing:

1. Check your GPC integration. Make sure applicable browser-level opt-out signals are recognized and reflected in the way your store handles personal information.
2. Review third-party trackers. Check recommendation widgets, advertising pixels, and marketing apps for tracking that activates without the required consent.
3. Make privacy requests accessible. Provide straightforward ways for customers to opt out of data selling or sharing, without unnecessary obstacles.
4. Test your live storefront. Verify that tracking behavior changes appropriately when visitors accept, reject, or opt out, especially after installing new Shopify apps or modifying your theme.

Conclusion

The latest privacy developments show that regulators are looking beyond privacy policies and cookie banner design.

They are examining how customer information is used, whether tracking respects consumer choices, and how easily people can exercise their rights.

For ecommerce businesses, privacy compliance increasingly depends on making sure that advertising, personalization, and data-sharing technologies behave consistently with those choices.

Consentmo helps Shopify merchants manage regional consent preferences, integrate privacy signals with Shopify, identify trackers, and monitor live storefront consent behavior.