Privacy ComplianceOpt-Out Signals
Is Your Website Honoring the Global Privacy Control as U.S. States Require?
Twelve U.S. states require businesses to honor the Global Privacy Control, a signal that visitors can send from their browsers to opt out of the sale and sharing of their personal information. However, many websites do not act on the signal at all, or act on it only after their tracking tools have already run. California has already fined businesses for failing to honor it.
By Alex Proctor
Published October 15, 2026
Summary
The Global Privacy Control (GPC) is a browser signal that tells websites that visitors want to opt out of the sale and sharing of their personal information. Because state laws treat it as a valid opt-out, the relevant tracking should stop as soon as the signal is received. California's regulations also extend the opt-out to known visitors, such as those who are logged in, and require websites to display whether the signal was honored. I recommend that businesses confirm how their websites respond when the signal is present, including whether it is applied before their tracking tools run.
How Does the Signal Reach Websites?
Browsers that support the Global Privacy Control send it in two forms. The signal travels as a header with each request that browsers make to websites. Scripts on the page can also read it as a browser property. The specification states that "a GPC signal will be attached to every HTTP request made to a given site."
This means that the signal tends to be delivered immediately, before visitors interact with a consent banner and before any tracking tools load. Today, the signal comes mainly from Brave, DuckDuckGo, Firefox, and privacy browser extensions. However, California will require browsers to include a setting for the signal starting in 2027, so more visitors are likely to send it as Chrome and others add support.
What Does Honoring the Signal Require?
California's regulations are the most detailed of the state requirements. Businesses have to treat the signal as a valid request to opt out of sale and sharing "for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles."
Due to the somewhat anonymous nature of web traffic, this can get a little complicated. When visitors are known to the business, the opt-out also applies to the personal information associated with them, such as their accounts. This has implications for logged-in visitors. It may also lead businesses to offer visitors an optional way to provide an email address or other identifier, to support a full opt-out of sale or sharing beyond disabling web trackers.
| Requirement | What California's Regulations Say |
|---|---|
| Scope | The browser or device, and any profile associated with it |
| Known visitors | The opt-out applies to the person, not only the device |
| Timing | As soon as feasibly possible, and within 15 business days |
| Status | The website must display whether the signal was processed |
Based on California's regulations (11 CCR 7025 and 7026), effective January 1, 2026.
For websites, timing is among the most important of these requirements. The general deadline is "as soon as feasibly possible, but no later than 15 business days." However, the regulations give the example of a website whose advertising technology shares personal information instantaneously, and they say that such a business "shall immediately comply." In practice, that points to applying the opt-out before the tracking tools run.
This can be technically challenging, particularly for websites that use opt-out consent models, where tags are set to run by default. By the time the signal reaches the script-gating layer, tags may have already fired. This can require additional configuration within tag managers. At an August 2026 meeting of California's privacy agency, staff reported that "many businesses do not check for GPC before deploying their tracking technologies."
California also requires websites to tell visitors whether their signal was honored. Since January 1, 2026, a business "must display whether it has processed" the signal as a valid request to opt out of sale and sharing. The regulations give the example of a message that reads "Opt-Out Request Honored," along with a toggle that shows visitors that they have opted out. Before 2026, this display was optional.
How Far Should the Opt-Out Reach?
In California, the signal works as an opt-out of the sale and sharing of personal information. Most other states treat it as an opt-out of the sale of personal information and of targeted advertising, which is similar to California's requirement. In practice, that most directly affects advertising tools. It can also apply to analytics tools whose vendors use the information for their own purposes, which can qualify as a sale under several state laws.
While many businesses originally focused on disabling targeting and advertising trackers in response to the signal, I am seeing a growing number of businesses treat the signal as an opt-out of all non-essential web tracking. In fact, at Captain Compliance, we process the signal this way by default.
Some insurance carriers have also asked their policyholders to apply this broader reading. The broader approach is often simpler to configure, because the opt-out works the same way for every tool. It may also reduce wiretapping exposure from analytics tools that would otherwise continue to run for visitors who expected to opt out. Whether to go beyond the legal minimum is a risk decision for each business, particularly for businesses whose analytics tool usage does not qualify as a sale.
How Do Websites Fall Short?
Websites often receive the signal without acting on it. In some cases, consent platforms record the signal while tracking tools that were not connected to them continue to run. In other cases, nothing on the website checks for the signal at all.
Honoring the signal has been a top enforcement priority in California. The state's first public enforcement action under its privacy law, against Sephora in 2022, involved the signal. In 2025, California also joined Colorado and Connecticut in a sweep of businesses that did not appear to be honoring it.
California's privacy agency has since found that PlayOn Sports "failed to configure its Digital Properties to recognize and honor" opt-out requests sent through these signals. It made a similar finding against Tractor Supply, which did not honor the signals until July 2024.
Regulators have also looked at how far the opt-out reaches. In February 2026, California's Attorney General announced a $2.75 million settlement with Disney. The announcement says that Disney limited these opt-outs "to the specific device the consumer was using, even when the consumer was logged into their account."
What Should Businesses Confirm?
Honoring the signal involves more than detecting it. Businesses that receive the signal should be able to confirm that:
- The signal is checked before tools that sell or share personal information run
- Every such tool is gated by the consent platform at the script level
- The opt-out is applied to known visitors as well as to their devices
- The website displays that the signal was honored
I recommend that businesses validate each of these points on their live websites, and again after any change to their tags or consent platform.
Questions
What happens if visitors clear their cookies?+
The signal still applies. Browsers send the Global Privacy Control with every visit, so it does not depend on a stored record of an earlier choice. California's regulations include an example of a consumer who clears her cookies and returns with the signal enabled. The business has to honor the signal for her browser or device, even though it no longer recognizes her.
Do browser extensions send the signal the same way that browsers do?+
Not always. Unlike browsers that support the signal directly, extensions typically add the header and the browser property through separate mechanisms. The property may not be in place at the moment a script first checks for it. Websites that check only the property may miss the signal in those cases, so checking the header on the server as well is a useful safeguard.
Do advertising vendors honor the signal on their own?+
Some do. For example, Google says that for users in certain states, Google Ad Manager receives the signal directly and applies restricted data processing to those ad requests. However, the legal obligation belongs to the businesses that operate the websites. Vendors do not all respond the same way, so businesses should validate each tool.
Briefings are informational and do not constitute legal advice.
Ready for the regulators?
I'll check your website for privacy law compliance.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.