An opt-out that no longer reaches the new destination.
Section 1798.120 is the right to direct a business not to sell or share personal information. Section 1798.135 is about the methods, including a homepage link titled Do Not Sell or Share My Personal Information. 11 CCR § 7025 says a business that sells or shares must also process a qualifying opt-out preference signal (including Global Privacy Control) for the browser or device, and for a known consumer when applicable. Processing the signal is not a substitute that lets you skip the link unless the frictionless-signal path in § 7025 applies. Sale and sharing are defined terms. A new SDK is not automatically either one.
The shapes the same control failure takes.
The useful diff is a destination or a signal path, not a banner. The recurring shapes:
A new ad or analytics destination
Identifiers or behavioral events start flowing to a third party used for cross-context advertising, and the existing opt-out state is not applied to that destination.
A GPC guard is removed
A check that read the Sec-GPC header or an equivalent preference signal is deleted, so data leaves before any signal is considered. Cite 11 CCR § 7025 for the processing duty, not § 1798.135 alone.
Tags fire before preference state loads
A tag manager or client bundle sends events on page load, and the opt-out or GPC state is read later, so the first hop ignores the preference.
Server-side events ignore the browser signal
The UI honors GPC and the server-side pipeline still forwards the same identifiers to a share destination.
A required link or signal path is deleted
The Do Not Sell or Share My Personal Information route, or the code that treated a preference signal as the method, is removed without an equivalent.
A conversion pixel that no longer reads Sec-GPC.
A growth pull request adds a client-side conversion pixel. The previous analytics wrapper skipped third-party beacons when Sec-GPC was 1. The new pixel is called directly.
- if (req.headers.get("sec-gpc") === "1") return;- track("convert", { id: user.anonId });+ window.fbq("track", "Purchase", { uid: user.id, email: user.email });This sends an identified conversion to a third-party advertising endpoint and drops the Sec-GPC guard. If this flow is a sale or a share under the statute, § 1798.120 and § 1798.135 plus 11 CCR § 7025 expect an opt-out preference signal to be processed for that browser or device before the data leaves. Classify the destination (sale, share, or service provider) and restore a signal path if it is sale or share. The review cannot make that classification from the diff alone.
What a privacy reviewer would verify
A privacy review asks whether opt-out state and qualifying preference signals still reach every destination that sells or shares personal information. A banner is not enough. 11 CCR § 7025 is about processing the signal, including associated pseudonymous profiles, not about displaying a CMP. A third-party SDK is not automatically a sale or a share. Ask for classification. Do not declare it.
A review, not a sale determination.
A pull-request review can identify a new destination or a dropped signal guard. It cannot determine whether CCPA applies, whether a transfer is legally a sale or sharing, or whether a service-provider exception covers it. GPC is not a ban on all processing. Select CCPA in org config if you want this duty reviewed. These pages are illustrative.