[Enforcement library](/enforcement) # Opt-outs across devices or services: one choice, many systems People make a privacy choice once and expect it to hold everywhere they use your service. These records concern choices that stayed on one device, one app or one database. Issue · 4 cases in the library · Source review: 19 October 2026 - What the issue is - Why regulators and plaintiffs care - What to check in your own systems - Cases in the library - Related law pages - Sources and limits ## What the issue is A choice made in a browser may never reach the TV app. An objection logged in a CRM may not reach the notification service. A setting labelled as a single control may cover only part of the processing. The California DOJ alleged that [Disney](/enforcement/disney)'s opt-outs did not reach all devices and services linked to an account. The Garante fined [BBVA](/enforcement/bbva-marketing-objection) after app notifications continued despite an objection. ## Why regulators and plaintiffs care European decisions show the same gap. CNIL's [CALOGA](/enforcement/caloga) decision covered withdrawal across its databases. The DPC's EUR 403 million [Google location](/enforcement/google-location-data) decision concerned Web & App Activity, Location History and Location Accuracy; the case page draws the lesson that location controls need clear purposes, lawful processing and retention limits. ## What to check in your own systems ### In the repository - Map every store that holds a privacy choice and every system that should read it. - Key choices to the account where one exists, not only to a device or cookie. - Check retries and failures when a choice propagates. ### In the browser and network - Opt out on the web, then watch traffic from your apps on the same account. - Test what each setting actually stops. ### With the people responsible - List every partner per platform and who forwards opt-outs to them. - Document purpose-specific retention and deletion for each system. ## Cases in the library 4 cases in the library are tagged with this issue, newest first. Each page has the record, the source and its procedural status. - [Google Ireland](/enforcement/google-location-data): Location controls need clear purposes, lawful processing and retention limits. Irish Data Protection Commission (DPC) · Decision 21 September 2026 · Administrative fines and six-month compliance order; full decision not reviewed. - [BBVA Italy](/enforcement/bbva-marketing-objection): Recording an opt-out is insufficient when the sending system never receives it. Italian Data Protection Authority (Garante) · Decision 3 July 2026 · Administrative fine and compliance order; later appeal status not established. - [Disney](/enforcement/disney): Make an opt-out follow the account, not the device. California DOJ · Announced 11 February 2026 · Settlement and stipulated judgment. - [CALOGA](/enforcement/caloga): Buying leads did not remove the duty to verify consent and honour withdrawal. CNIL · Decision 15 May 2025 · Administrative fine; later appeal status not established. ## Related law pages The laws most often cited in these cases: - [CCPA](/enforcement/laws/ccpa): linked from 1 of the cases above ## Sources and limits The sources for each case are on its case page. [Read how to use the library](/enforcement#how-to-read). Source review: 19 October 2026. This page groups the cases Inth has tagged with this issue and summarises each record at its procedural stage. An allegation is not a finding, and a settlement does not establish liability after trial. Tentative rulings are labelled and may change at the hearing. Inth assigns the issue labels and implementation checks. It is not legal advice. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance. ### Should an opt-out follow the account? The California DOJ alleged in \[Disney\](/enforcement/disney) that opt-outs did not reach all the devices and services linked to an account. ### What if our systems are run by different teams? In \[Disney\](/enforcement/disney) and \[BBVA\](/enforcement/bbva-marketing-objection) the choice was recorded in one place and not applied in another. Giving one owner the choice and its propagation is a practical engineering step. ### Does this only apply to advertising? No. \[BBVA\](/enforcement/bbva-marketing-objection) concerned marketing notifications and \[Google location\](/enforcement/google-location-data) concerned location controls.