Consent That Follows the Account, Not the Browser: The Logged-In Problem
A visitor opts out on their laptop and logs in on their phone the next morning. The ads resume. The banner never reappears, because the cookie on the phone says nothing is wrong, and the account on the server never heard about the opt-out. Nothing in the flow looks broken. Every piece of it did exactly what it was built to do, and the result is still a violation.
This is the failure the California attorney general put a price on in February 2026. In the $2.75 million Disney settlement, GPC opt-outs were limited to a single device even when the consumer was logged in. The signal arrived. The company processed it for the browser that sent it and stopped there. The account kept selling and sharing as if the visitor had never opted out.
The regulation's logged-in example
California's regulation at 11 CCR section 7025 does not leave this to interpretation. A valid opt-out preference signal is an opt-out for that browser or device and any consumer profile associated with it, including pseudonymous profiles. If the consumer is known, it is also an opt-out for the consumer, including account and offline sale or sharing, in the regulation's logged-in example. The words "if the consumer is known" do the work. A logged-in visitor is known. Their opt-out travels with the account.
That makes the device-only CMP the weak link. Most consent tools were built around a cookie: a visitor chooses, the choice is stored in the browser, and the next visit reads it back. The model is fine for anonymous traffic. It breaks the moment the visitor has an account, because the account is the durable identity and the cookie is a per-device copy of it. An opt-out recorded only in a cookie is an opt-out that dies with the cookie.
Why most CMPs stop at the device
The reason is architectural, not malicious. Consent state lives in the browser because that is where the banner runs, and syncing it to a server-side profile means the CMP has to talk to the identity system, the CRM, and every downstream vendor that receives sale or sharing data. Each of those integrations is a project, and each one has an owner who will ask whether the regulation really requires it. After February 2026, the answer is a settlement document, not an opinion.
The same gap shows up in the other direction. A visitor who opts out while logged in, then clears cookies, gets the banner again and may accept out of habit. The regulation's answer is that the GPC signal, when present, takes priority over the banner choice. The account-level record is what makes that answer enforceable. Without it, the banner choice overwrites the opt-out and nobody notices.
What account-level honoring actually takes
The fix has four parts, and only the first lives in the CMP. First, the consent record needs a stable identifier that survives the browser: the account ID for logged-in visitors, or a pseudonymous profile ID the business already maintains. Second, the opt-out has to propagate to the identity graph, so a signal on one device marks the profile everywhere. Third, the downstream vendors need the updated flag, including the embedded third-party ad-tech the Disney settlement called out. A flag that stops at the CMP dashboard is a note, not an opt-out. Fourth, the site has to show the signal was processed, which the updated regulations require as of January 1, 2026.
None of this is exotic technology. It is the same sync work teams already do for marketing preferences and suppression lists. The difference is that consent is usually treated as a front-end problem while preferences are treated as a data problem. The regulation treats them the same way.
The test that catches it
Run it with two browsers and one account. Turn GPC on in browser A, log in, and confirm the opt-out. Then log into the same account in browser B with GPC off and check whether the sale and sharing flags are still suppressed. If the ads resume in browser B, the opt-out never left the first device. Fix the sync before the next audit, because the next audit will run exactly this test.
Keep reading: Do Not Sell or GPC: Which One California Checks First, Consent Withdrawal Has to Work Everywhere, Not Just on the Homepage, What a Consent Record Has to Contain to Hold Up cover the nearby cases in this series.
Frequently asked questions
Does an opt-out have to apply across devices?
Yes, when the business knows who the consumer is. Under 11 CCR section 7025, a valid opt-out preference signal covers the browser or device and any associated consumer profile, including the account. A device-only opt-out is the gap the Disney settlement penalized.
What if the visitor is not logged in?
Then the opt-out applies to that browser or device and any pseudonymous profile linked to it. The account-level duty only attaches when the consumer is known, but the device-level duty applies either way.
Does this apply to offline sale or sharing?
Yes. The regulation's logged-in example says the opt-out covers the consumer, including account and offline sale or sharing. An opt-out that stops at the website while the CRM keeps selling the same profile is not honored.
How long before we can ask an opted-out visitor to opt back in?
Wait at least 12 months after an opt-out through a preference signal before asking the visitor to opt back in, under sections 7025 and 7026. A re-prompt that fires sooner is itself a compliance problem.