Privacy ComplianceOpt-Out Signals
California Will Require Browsers to Support the Global Privacy Control in 2027
Global Privacy Control and other universal opt-out mechanisms are not widely used today. The signals tend to be available from a few privacy-focused browsers and extensions. Starting January 1, 2027, California's Opt Me Out Act requires every browser provider to include "opt-out preference signal" options, which will change how much Internet traffic arrives with an opt-out attached.
By Alex Proctor
Published September 13, 2026
Summary
The California Opt Me Out Act (AB 566) was signed on October 8, 2025 and takes effect on January 1, 2027. It requires every browser offered in California to include a consumer-configurable setting for sending an opt-out preference signal, such as the Global Privacy Control (GPC). Currently, only a subset of providers (DuckDuckGo, Brave, Firefox, etc.) send the signal natively. Once more mainstream browsers (Chrome, etc.) add native GPC support, the share of visitors arriving with an automated opt-out will climb, and state privacy regulators will expect websites to keep up.
What Does the Opt Me Out Act Require?
The law adds Section 1798.136 to the California Consumer Privacy Act. Starting January 1, 2027, every business that develops or maintains a browser must include functionality, configurable by the consumer, that enables the browser to send an opt-out preference signal. The signal must communicate the consumer's choice to opt out of the sale and sharing of personal information. While the bill language does not focus on the GPC, it is the practical standard that browser providers will implement to meet this requirement.
The required setting has to be easy for a reasonable person to locate and configure, and the browser provider also has to explain in its public disclosures how the signal works and what it is intended to do.
The California Privacy Protection Agency may adopt regulations to implement the section. Browser providers that offer the setting get a safe harbor when a website fails to honor the signal, which maintains the compliance burden where it already sits, on the website.
Which Browsers Send the Signal Today?
The GPC was created in 2020, and the browsers that include GPC options natively tend to be the privacy-focused ones. Users of Chrome and other mainstream browsers have historically required extensions, like Captain Compliance: GPC, to deliver the signal.
| Browser | Sends GPC natively | How |
|---|---|---|
| DuckDuckGo | ✓ | On by default |
| Brave | ✓ | On by default |
| Firefox | ✓ | Setting |
| Chrome | ✗ | Extension only |
| Safari | ✗ | Extension only |
| Edge | ✗ | Extension only |
Native support per globalprivacycontrol.org, as of September 2026.
Currently, Chrome, Edge, and Safari (three browsers that carry the highest proportions of Internet traffic) are the three without native support. That is what the law will change. Any browser offered to California residents has to add the setting.
Why Does It Matter Outside California?
GPC signals do not carry a state of residence. A website receives the same GPC headers from visitors in Maryland as it does from Californian visitors, and the duty to honor them already exists under twelve state laws (with Louisiana and Vermont joining in 2027 and 2028). Those obligations do not change, but the volume will.
Today, a site might identify opt-out signals from a small share of visitors. After the mainstream browsers ship the setting, the share will depend on how prominently each browser presents it and whether any turn it on by default. A site that handles the signal correctly today has nothing to fix, and a site that does not will have the gap exposed on far more visits, increasing the risk of regulatory action.
What Should a Website Do Before 2027?
The defensible configuration is the same one that has already been required by the modern state privacy laws. Consent management platforms should detect the signal on arrival and apply opt-outs immediately, without requiring a manual banner interaction. At a minimum, targeting and marketing tracking should be disabled, but it may be prudent to disable non-essential tracking more broadly in response to the signal. Additionally, websites may need a mechanism to process GPC beyond basic web tracking (passing the signal downstream for logged-in users, or offering options for visitors to provide basic identifying details for more complete opt-out processing).
I recommend treating the browser mandate as a useful deadline for confirming GPC processing that should already be in place. I also recommend supporting GPC from all regions, not just the states that specifically require UOOM support.
Questions
Does the Opt Me Out Act apply to businesses that do not make browsers?+
Not directly. The obligation falls on any business that develops or maintains a browser. Websites are affected indirectly. While the existing duty to honor the signal under California law (and several other state laws) does not change, the share of visitors sending opt-out signals is expected to increase significantly.
Will the signal be turned on by default?+
Not necessarily. The law requires a setting that a consumer can find and configure, and it leaves the default to each browser provider. Among the browsers with native support today, DuckDuckGo and Brave send the signal by default, while Firefox leaves it off until the user turns it on.
Does the signal replace a consent banner?+
No. The signal communicates one choice, an opt-out from the sale and sharing of personal information, or from sale and targeted advertising in most other states. It does not express consent to anything, and it does not cover every cookie category. A site still needs a way to collect and enforce the other choices it offers, and it needs to apply the signal without waiting for the banner to be clicked.
Briefings are informational and do not constitute legal advice.
Ready for the regulators?
I'll check your website for privacy law compliance.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.