What evidence do auditors commonly ask for on CCR 7025 Process opt-out preference signals?

Technical design showing GPC detection at page load and suppression of selling or sharing tags; Test results from browsing with the signal enabled, including network captures; Website display of the signal status to the visitor; Logic linking the signal to logged-in accounts and offline records where the consumer is known.

What is the most common gap auditors find on CCR 7025?

Signal honoured only for cookies, not for logged-in account data

CCPA/CPRA · Opt-out of sale or sharing, limiting sensitive data and preference signals

`CCR 7025` Process opt-out preference signals

A business that sells or shares data must treat a widely recognised browser or device signal, such as Global Privacy Control, as a valid opt-out for that browser or device and every profile linked to it, including pseudonymous ones, and for the consumer where known. It may not ask for more than the signal, must apply the signal even where it conflicts with an earlier privacy setting (it may then ask for consent), may not read the later absence of a signal as consent, and must show on its website whether the signal was honoured (for example Opt-Out Request Honored). To skip posting the links under section 1798.135(b), it must process signals in a frictionless way, without fees, pop-ups or degraded experience, and meet the extra conditions in subsection (g).

Source: CCPA/CPRA, CCR 7025. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Test results from browsing with the signal enabled, including network captures · Source control / CI pipeline
Logic linking the signal to logged-in accounts and offline records where the consumer is known · Identity provider / directory

governing documentDocuments that govern the control

Technical design showing GPC detection at page load and suppression of selling or sharing tags · Document repository
Website display of the signal status to the visitor · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Signal honoured only for cookies, not for logged-in account data
Advertising calls fired before the signal is read
No visible confirmation that the signal was processed

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

CCR 7024 Respond to requests to know: search scope, protected data and portals · CCR 7026 Handle requests to opt out of sale or sharing