Key points

• A universal opt-out signal, such as Global Privacy Control, lets a person tell every website they visit that they opt out of the sale or sharing of their personal data and targeted advertising.
• California and a growing number of other states require businesses to treat a valid signal as a request to opt out, and regulators have brought enforcement actions where websites ignored it.
• California has enacted a law that will require browsers to offer a built-in opt-out preference signal, which will make signals more common and easier to use.
• Honoring a signal is a technical and organizational task, covering consent management, tag configuration, server-side data flows and the treatment of known users.
• Companies should test their sites with the signal on, reconcile conflicts with other consent choices and document the logic.

What the signal is

Global Privacy Control, commonly called GPC, is a browser setting and technical specification that transmits a person's opt-out preference to websites automatically. It is sent as an HTTP header and exposed as a JavaScript property when the setting is enabled, either in the browser itself or through an extension. A person who turns it on need not click an opt-out link on each website. The signal is designed to express a general preference to opt out of the sale or sharing of personal information and, under several laws, targeted advertising.

Regulators like the mechanism because privacy rights are hard to exercise at scale if each site requires its own request. For businesses, the signal changes opt-out from a manual process into an automated one that must work reliably.

Where the law requires it

California's privacy regulations require businesses to process opt-out preference signals as valid requests to opt out of sale and sharing, for the browser or device and, where the business can associate the signal with a known consumer, for that consumer's account. Colorado requires controllers to honor universal opt-out mechanisms that meet technical specifications set by the attorney general, and the state has recognized GPC. Connecticut, Texas, Montana, Oregon, New Jersey, Delaware, Nebraska, Minnesota, Maryland and other states have similar requirements, with effective dates that differ. Some states require recognition only for targeted advertising and sale, others for profiling as well. Businesses should check the specifics for each state in which they operate.

Enforcement signals

The first public enforcement actions under California's law concerned a failure to honor GPC. In 2022, the California attorney general announced a settlement with an online beauty retailer that included a payment and obligations to honor the signal, and further settlements have followed, some from the state's privacy agency. State authorities have also announced investigative sweeps that test whether websites respond to the signal, and several have signaled that they are working together on coordinated reviews. The pattern is consistent. Regulators can test the issue cheaply by visiting a site with the signal enabled and checking whether advertising cookies and data transfers continue.

These cases tend to involve third-party advertising and analytics tags that fire regardless of the signal, consent banners that tell users their choices have been honored when they have not, and failures in the handling of data once it is passed to vendors.

Browsers are coming on board

California enacted legislation in 2025 that will require browser developers to include a setting allowing consumers to send an opt-out preference signal, with the obligation applying from 2027. Several browsers already support GPC natively, and others support it through extensions. As more browsers make the setting easy to find, the number of visitors sending the signal will rise, and the cost of failing to honor it will rise with it. Businesses should therefore treat GPC as a mainstream channel rather than a niche one.

Implementation challenges

Technical detection. The site must detect the signal on page load, before advertising or analytics tags fire. Tag management configurations that wait for a consent banner interaction may not read the header. Server-side tagging and mobile apps need separate treatment, since GPC is a browser mechanism and apps may rely on other platform signals and in-app controls.

Known users. Where a user is logged in or otherwise identifiable, the signal should be applied to the account where the law requires, and conflicts with earlier consent choices need a rule. California's regulations address a conflict between the signal and a financial incentive program, for example, by permitting the business to ask the consumer to confirm their choice.

Downstream vendors. The opt-out must reach advertising partners and processors, which usually means passing a flag or suppressing calls. Contracts and technical integrations should reflect this.

Consent banners. If a site displays a banner, the interface should reflect that the signal has been recognized. Messages and design that nudge users to reverse the choice can be challenged as dark patterns.

Evidence. Record how the site responds to the signal and test regularly, including after website releases and tag changes. Regressions are common, and regulators will not distinguish between an intentional failure and an accidental one.

A response plan

Test every major domain and app with GPC enabled and observe what data flows. Update tag management and consent tooling, and confirm that the rules for each state are applied. Review the privacy notice, which should explain how the business responds to signals. Ensure that vendors can receive and honor opt-out flags. Assign ownership between legal, marketing and engineering, since signals touch all three, and add GPC checks to release testing.

Our broader note on the 2026 state privacy compliance map sets out how these obligations fit with other state requirements.

Corvane Ryle's Privacy & Cyber practice and Advertising Technology & Marketing Privacy practice advise on opt-out implementation, advertising technology contracts and regulatory inquiries. Tomás Ellery-Vance is available to discuss testing methodology and regulator expectations.