Global Privacy Control (GPC): what California requires

A browser or extension with GPC turned on sends the signal with every page request as an HTTP header (Sec-GPC: 1) and exposes it to scripts on the page as a JavaScript property (navigator.globalPrivacyControl). The visitor sets it once; every site receives it without the visitor clicking anything.

The CCPA regulations call this an opt-out preference signal and describe it in exactly these terms: a signal “in a format commonly used and recognized by businesses”, for example “an HTTP header field or JavaScript object” (11 CCR § 7025(b)(1)). Its purpose is to let consumers opt out with all businesses at once, “without having to make individualized requests with each business” (§ 7025(a)).

The signal is becoming more common. Under the California Opt Me Out Act (AB 566), signed on October 8, 2025, browsers must include a setting that sends an opt-out preference signal; the requirement takes effect in January 2027.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA) · CPPA announcement on AB 566

A business that sells or shares personal information “shall process any opt-out preference signal” that meets the regulation’s requirements “as a valid request to opt-out of sale/sharing” (11 CCR § 7025(b)). In the CCPA, “sharing” means disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands (Cal. Civ. Code § 1798.140(ah)). The regulations then spell out what processing the signal means:

• The opt-out applies to that browser or device and to any consumer profile associated with it, including pseudonymous profiles — and to the consumer, if the business knows who they are (§ 7025(c)(1)).
• The business may not require more information than is needed to send the signal (§ 7025(c)(2)).
• If a known consumer later visits without the signal, its absence is not consent to opt back in (§ 7025(c)(5)).
• The business must show on its website whether it has processed the signal, for example with the words “Opt-Out Request Honored” (§ 7025(c)(6)).
• Posting a “Do Not Sell or Share” link does not replace the signal: “Even if the business posts the above-referenced links, the business must still process opt-out preference signals” (§ 7025(e)).
• Selling and sharing must stop as soon as feasibly possible and no later than 15 business days after the request (§ 7026(f)(1)).

These duties apply to businesses covered by the CCPA. A for-profit business is covered if it meets one of three thresholds: annual gross revenue above $25 million as adjusted ($26,625,000 since January 1, 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of its revenue from selling or sharing personal information (Cal. Civ. Code § 1798.140(d)). A business that does not sell or share personal information does not have to process the signal (§ 7025(b)).

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA) · CCPA, Cal. Civ. Code § 1798.100 ff. (CPPA) · CPPA, adjusted monetary thresholds

The question is simple to ask and easy to get wrong: does anything that sells or shares data stop when the signal is on? A fair test compares two visits that differ only in the signal.

• Use a fresh browser profile without stored cookies or earlier consent choices. Open your home page, wait for it to settle and note every third-party host in the browser’s network panel.
• Turn GPC on (some browsers have a built-in setting; extensions add it to others), start another fresh profile and load the same page the same way.
• Compare the lists. Look for advertising pixels and cross-site tracking services that still load and still receive identifiers with the signal on.
• Repeat each visit a few times. Pages load different services from one visit to the next on their own, so a single pair of visits can mislead.
• Check that the site tells the visitor the opt-out was honored, as § 7025(c)(6) requires.
• If visitors can log in, test with an account too: the opt-out should follow the known consumer, not just the browser.

Keep what you observe separate from what it means. A service that keeps loading with the signal on is a measurement. Whether that service receives data as a sale or sharing depends on its role and your contract with it, which no browser test can see.

Most sites that ignore the signal do not do so on purpose. The signal arrives, but the tags are wired in a way that never asks for it.

• Tags fire before the consent tool reads the signal. A tag manager starts advertising pixels as soon as the page loads; the consent tool evaluates GPC a moment later, after the first requests have already gone out.
• The consent tool is configured not to act on GPC, or acts on it only for visitors it locates in certain regions. Its setting decides whether the signal does anything at all.
• Server-side tagging. The browser sends events to your own domain, and your server forwards them to advertising platforms. The browser’s network panel shows only first-party requests, and unless the server checks the Sec-GPC header, the data flows on regardless.
• The signal switches off cookie categories but not the sale or sharing itself. The regulations say a cookie banner or cookie controls are “not by itself an acceptable method” for opting out of sale or sharing (§ 7026(a)(4)).
• The opt-out sticks to the device only, even for consumers the business knows because they are logged in.

Sources: CCPA regulations, 11 CCR § 7000 ff. (CPPA)

California’s regulators have named the signal in several published actions. In a settlement the Attorney General announced on August 24, 2022, Sephora agreed to pay $1.2 million; opt-out requests sent through Global Privacy Control had not been processed as opt-outs of sale. On July 1, 2025, Healthline Media agreed to $1.55 million after its consent banner did not disable tracking cookies as it said it would. On September 30, 2025, the California Privacy Protection Agency announced a $1.35 million fine against Tractor Supply for failing to offer an effective way to opt out, including through signals such as GPC. On February 11, 2026, the Attorney General announced a $2.75 million settlement with Disney, whose GPC opt-outs applied only to the device that sent them, even for logged-in consumers.

On September 9, 2025, California, Colorado and Connecticut announced a joint investigative sweep of businesses that do not appear to process Global Privacy Control opt-outs.

Sources: California Attorney General, Sephora · California Attorney General, Healthline · CPPA, Tractor Supply · California Attorney General, Disney · California Attorney General, GPC sweep