Introduction
A website can feature a 'Do Not Sell or Share My Personal Information link, but still fail to act on a "browser based" opt-out signal received from a user. Global Privacy Control (GPC) enables a browser or browser extension to convey a privacy preference, without requiring users to opt out on each website.
The practical implication for website owners is: Does an applicable law require that the website honour the out-signal, and do advertising technology and data partners implement the opt-out?
As of October 2026, several U.S. state privacy laws require covered businesses to recognise qualifying universal opt-out preference signals or mechanisms, including Global Privacy Control (GPC). The applicable rights, statutory language and implementation requirements differ by state. Not every law uses the term ‘GPC’ expressly, and not every business is covered by every state law.
What is Global Privacy Control?
Global Privacy Control is a technical specification that expresses a privacy preference through a browser setting, extension or supported mechanism. It primarily indicates a preference not to sell or share personal information, or to avoid targeted advertising, where the law gives that right. The signal can be sent via an HTTP request header and made available to JavaScript code via a property.
GPC is not a statute and does not create a right itself. Its impact derives from the laws governing the business and consumer; state statutes and regulations specify when it must be honored as an effective request.
GPC is also distinct from a cookie banner. A banner is part of a website’s interface; GPC is a preference signal sent by the user’s browser or other supported mechanism. Banners may still have a role to play or be mandated by law, but their display does not shield a covered business from processing a valid GPC signal.
Which states require businesses to honour GPC?
The following is a summary of the 12-states group commonly referred to as needing universal opt out signals like GPC. The dates below refer to the commencement date of the relevant signal obligation as commonly reported; they are not the date the whole of the privacy statute came into effect. Statutory coverage thresholds, exemptions, definitions and implementation rules continue to matter.
| State | Applicable law | Relevant date | What website owners should know |
|---|---|---|---|
| California | California Consumer Privacy Act (CCPA), as amended by the CPRA; 11 CCR § 7025 | Current statutory framework: 1 January 2023 | Must process qualifying opt-out preference signals for applicable sale and sharing opt-outs. GPC is expressly addressed in the regulations. |
| Colorado | Colorado Privacy Act (CPA); C.R.S. § 6-1-1313; CPA Rules | 1 July 2024 | Must recognise a qualifying universal opt-out mechanism for applicable sale and targeted-advertising opt-outs. Colorado identifies GPC as a recognised mechanism. |
| Connecticut | Connecticut Data Privacy Act (CTDPA); Conn. Gen. Stat. ch. 743jj | 1 January 2025 | Must honour qualifying opt-out preference signals for applicable sale and targeted-advertising opt-outs, subject to statutory requirements. |
| Texas | Texas Data Privacy and Security Act (TDPSA); Tex. Bus. & Com. Code ch. 541 | 1 January 2025 | Review the authorised-agent and browser-technology provisions, including their conditions and the business’s statutory coverage. |
| Montana | Montana Consumer Data Privacy Act (MCDPA); Mont. Code Ann. tit. 30, ch. 14, part 28 | 1 January 2025 | Review the statutory universal opt-out requirements and the sale and targeted-advertising rights covered by the signal. |
| New Hampshire | New Hampshire Privacy Act; RSA ch. 507-H | 1 January 2025 | Review the qualifying mechanism, covered opt-out rights and statutory conditions, including applicable profiling rights. |
| Nebraska | Nebraska Data Privacy Act; Neb. Rev. Stat. §§ 87-1101 et seq. | 1 January 2025 — verify applicable mechanism conditions | Section 87-1111 addresses authorised agents and browser settings or extensions. Do not assume its conditions are identical to those of other states. |
| New Jersey | New Jersey Data Privacy Act; N.J. Stat. §§ 56:8-166.4 et seq. | 15 January 2025 — general law effective date | The statute addresses universal opt-out mechanisms. Check the operative provision and its scope when implementing sale and targeted-advertising opt-outs. |
| Minnesota | Minnesota Consumer Data Privacy Act; Minn. Stat. ch. 325O | 31 July 2025 | Review the universal opt-out provisions, applicable processing rights and any statutory conditions. |
| Maryland | Maryland Online Data Privacy Act (MODPA); Md. Code, Com. Law tit. 14, subtit. 47 | 1 October 2025 — general law effective date; verify the signal-specific implementation date | Section 14-4706 addresses authorised agents and browser-based technology. Confirm the operative signal requirements before implementation. |
| Delaware | Delaware Personal Data Privacy Act (DPDPA); Del. Code tit. 6, ch. 12D | 1 January 2026 | Review the universal opt-out requirements for covered sale and targeted-advertising activities and confirm the applicable statutory conditions. |
| Oregon | Oregon Consumer Privacy Act (OCPA); Or. Rev. Stat. §§ 646A.570–646A.589 | 1 January 2026 | Review the operative universal opt-out provisions and apply the signal to the processing covered by Oregon law. |
One important qualification here is that some laws go into detail about the nature of universal opt-out mechanisms or preference signals, while others refer to browser settings, global device settings or similar technology. While GPC is the most developed and widely implemented mechanism, the applicable statute and rules are the legal test. Colorado currently names GPC as its recognised mechanism.
What does a GPC signal require a business to do?
Where an applicable law recognises the signal, the business must treat it according to the opt-out rights covered by that law. Depending on the jurisdiction, these may include the sale of personal data, targeted advertising or sharing for cross-context behavioural advertising. The signal’s legal effect should not be assumed to extend to every processing activity or profiling decision. Depending on the state and the business’s activities, the processing involved can be:
• The sale of personal data or personal information, as defined by the applicable law.
• Sharing personal information for cross-context behavioural advertising, if the relevant law contains that concept.
• Processing personal data for targeted advertising.
• In some state laws, profiling in furtherance of decisions that have legal or similarly significant effects. A signal-based right’s scope must be determined by reference to the particular law; do not assume that a GPC signal automatically opt outs a business from all profiling.
For a website owner, the operational implication may be suppression advertising or analytics tags that involve a covered sale, sharing or targeted-advertising activity; update the user’s privacy preference; and ensure that processors, advertising partners or other downstream recipients are consistent with the opt-out. Is a specific cookie or vendor activity a “sale,” “sharing,” or “targeted advertising” is a legal and factual determination, not a conclusion that can be reached based merely on a cookie’s name.
California: the foundational example
California’s California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives consumers the right to opt out of the sale of personal information and sharing for cross-context behavioural advertising. The CCPA regulations address opt-out preference signals in 11 California Code of Regulations § 7025.
For covered businesses, a qualifying opt-out preference signal must be processed in accordance with the applicable regulations. A “Do Not Sell or Share My Personal Information” link is not a substitute for honouring a qualifying signal where the law requires it.
Website owners should also review how the regulations address browser-level preferences, consumer accounts and conflicting privacy choices. These issues should be handled according to the current regulatory text, rather than through a blanket assumption that every signal overrides every prior choice in every circumstance.
The California Privacy Protection Agency publishes the current CCPA regulations and related rulemaking materials. Businesses should consult the operative text when designing their opt-out processes and reviewing their consent-management and advertising technologies.
Enforcement example: the Sephora settlement
On 24 August 2022, the California Attorney General announced a $1.2 million settlement against Sephora, Inc., alleging that the company, among other claims, failed to disclose that it sold consumer personal information and failed to honor consumer opt-out requests sent via user-enabled Global Privacy Controls (GPC). The settlement required that Sephora update its disclosures and privacy practices, enable its consumers to opt-out via GPC, update its service-provider agreements, report to the state’s attorney general, and pay a $1.2 million penalty to the state.
The settlement related a browser signal to actual consequences for the company. However, this was a California CCPA case, not a court order that every website in every state must respect GPC. Its takeaway is that having a privacy policy or an opt-out link on a website does not make a company immune to the obligation to respect the GPC opt-out signal if it is required by law.
How website owners should implement GPC
A compliance programme should reflect legal analysis to the actual website and its data flows. Website owners should take the following steps at a minimum:
• Map coverage. Determine which state privacy laws apply based on the business, data, consumers' location and statutory thresholds and exemptions. Do not assume that all businesses are subject to every law, or that a business below a threshold applies in another state.
• Detect the signal. Test the website and relevant consent-management platform for the GPC signal, including the request header and the supported browser-side signal. Confirm behaviour across major browsers, subdomains and relevant page templates.
• Apply the opt-out to relevant processing. Configure advertising pixels, retargeting tags, analytics and other vendors to stop or otherwise restrict processing subject to the consumer's opt-out. Maintain a record of the preference without collecting or retaining additional information unnecessarily.
• Propagate the choice. Review processor, service-provider and advertising-partner contracts and technical implementations. A signal is not meaningfully honoured if the front-end recognises but downstream systems continue the restricted sale, sharing or targeted advertising.
• Review account and device logic. Determine how a browser-level signal interacts with a logged-in account, previous privacy settings and any legally permitted exceptions. Follow the applicable state's conflict rules rather than overriding the signal or ignoring an earlier choice.
• Update disclosures. Describe in the privacy notice how opt-out rights may be exercised and how the business responds to universal opt-out signals, where applicable. Ensure the notice accurately reflects actual technical behaviour.
• Test and document. Use a repeatable test plan, retain evidence of signal receipt and downstream suppression, monitor vendor changes and periodically re-test after website releases. Document exceptions and the legal basis for them.
Check whether consent-management, tag-management and advertising vendors actually apply the opt-out; a dashboard entry alone is not proof of compliance.
Does GPC apply to every cookie or every website?
No. GPC is not necessarily a complete opt-out from all tracking or other personal-data processing. Its effect depends on the opt-out rights and definitions in the applicable law. Some first-party analytics or other processing is necessary to provide the requested service; some processing falls outside a specific law’s definition; and some laws contain specific exemptions. Likewise, the publisher should not assume that a third-party tracker is per se exempt simply because it is used for “analytics” or provided by an advertising platform.
The signal sent by GPC is not an exemption from other privacy-law obligations. The website may still be required to provide a privacy notice, utilise data minimisation and security measures, obtain separate consents (for example, for processing sensitive data), or implement procedures for access, deletion, correction or objection rights. All this, in addition to compliance with the GDPR or other laws in the relevant country, may be required if the website is in a jurisdiction with separate cookie or e-privacy laws.
What about states that do not expressly require GPC?
Not all U.S. state privacy laws explicitly require the recognition of GPC or any other universal opt-out mechanisms by businesses. Moreover, there are states that establish the right to opt out but specify alternative ways of opting out or do not mention the signal-specific obligation at all. In this regard, the list of states that have adopted privacy laws is not identical to the list of states that require businesses to enable the opt-out signals in browsers.
National-scale businesses may decide to adopt the GPC signal in order to limit the possibility of being detected while tracking users' locations. However, such a decision does not necessarily testify of the uniformity of obligations as imposed by state laws; the obligation should be implemented on the company's website and its vendors.
Conclusion
Global Privacy Control (GPC) is a browser preference that creates a legally enforceable opt-out signal in any jurisdiction with privacy laws that recognize such a preference. As of October 2026, the state landscape includes, but is not limited to: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. The specific reach of GPC is determined by the laws and regulations, effective dates, and scope of coverage of each state's specific statutes.
For website owners, the key compliance-related concern is whether they will take the necessary steps to halt the covered activities whenever a qualifying GPC signal is received by the business in question, including by its vendors. The Sephora settlement serves as a reminder that businesses must ensure that they are not only in compliance with the law, but also able to demonstrate that they are taking the steps necessary to be in compliance. Companies should review the law, test the technology, and ensure that their policies are consistent with the activities that will actually take place on their website.
Authoritative sources and further reading
- Global Privacy Control — official project website and FAQ
- Colorado Attorney General — Universal Opt-Out and the Colorado Privacy Act
- Connecticut Attorney General — The Connecticut Data Privacy Act
- California Attorney General — Sephora CCPA settlement announcement (24 August 2022)
- California Privacy Protection Agency — Laws and regulations
- Oregon Legislature — Oregon Revised Statutes, Chapter 646A
- Delaware Code — Delaware Personal Data Privacy Act, Title 6, Chapter 12D
- Minnesota Revisor of Statutes — Laws of Minnesota 2024, Chapter 121 (universal opt-out mechanisms)
- Maryland General Assembly — Commercial Law § 14-4706
- Montana Legislature — MCA § 30-14-2808
- Google AdSense Help — Universal Opt-Out Mechanism provisions update (30 June 2025; implementation reference)