Privacy ComplianceOpt-Out Signals
There's (Still) No Opting Out of Universal Opt-Outs
Website visitors can send businesses an automated privacy opt-out signal from their browser, and respecting that signal is mandatory under twelve state privacy laws, with more coming into effect in 2027 and 2028.
By Alex Proctor
Published September 12, 2026
I originally wrote this content for the IAPP, which published it on July 2, 2025 as There's no opting-out of universal opt-outs. I've since refreshed the material below with new updates.
Summary
A universal opt-out mechanism (UOOM) lets a website visitor declare a privacy opt-out automatically, from the browser, and most state privacy laws now require businesses to honor it. The Global Privacy Control (GPC) is the only UOOM that state regulators consistently recognize, and twelve states already require businesses to treat it as a valid opt-out from data sales and targeted advertising. Additionally, Louisiana is adding the requirement in 2027, while Vermont is doing the same in 2028.
What Is a Universal Opt-Out?
A universal opt-out mechanism (UOOM) lets a person declare a privacy preference from their browser and have it delivered automatically to every website they visit. The concept itself is not new. A prior standard called "Do Not Track" was proposed in 2009, although it failed to gain widespread support for lack of enforcement.
The Global Privacy Control, developed in 2020, is the modern equivalent, with regulatory teeth behind it. Website visitors can activate GPC from a supporting browser, or through an extension, and the underlying opt-out request travels as an HTTP header and a JavaScript variable with every page request. GPC is widely understood as a "Do Not Sell or Share" preference.
Which States Require It?
Fourteen state comprehensive privacy laws require, or will soon require, businesses to honor a universal opt-out signal, and each of those states can take regulatory action when a business does not. Some of these states specifically name GPC as a required UOOM. The others take an agnostic approach to which signal qualifies, and GPC support is implied. Note that Nebraska and Texas, absent from the table, only require UOOM support for businesses already obligated under another state's law.
| State law | UOOM requirement effective | UOOM opt-out categorically required | GPC opt-out specifically required |
|---|---|---|---|
| California Privacy Rights Act | 07-01-2023 | ✓ | ✓ |
| Colorado Privacy Act | 07-01-2024 | ✓ | ✓ |
| Connecticut Data Privacy Act | 01-01-2025 | ✓ | ✓ |
| Montana Consumer Data Privacy Act | 01-01-2025 | ✓ | ✗ |
| New Hampshire Privacy Act | 01-01-2025 | ✓ | ✗ |
| New Jersey Data Privacy Act | 07-15-2025 | ✓ | ✓ |
| Minnesota Consumer Data Privacy Act | 07-31-2025 | ✓ | ✗ |
| Delaware Personal Data Privacy Act | 01-01-2026 | ✓ | ✗ |
| Oregon Consumer Privacy Act | 01-01-2026 | ✓ | ✗ |
| Maryland Online Data Privacy Act | 04-01-2026 | ✓ | ✗ |
| Louisiana Data Privacy Act | 01-01-2027 | ✓ | ✗ |
| Vermont Data Privacy and Online Surveillance Act | 01-01-2028 | ✓ | ✗ |
Laws in effect and pending, as of September 2026.
What Does Honoring the Signal Mean in Practice?
Businesses have to decide which opt-outs the signal triggers, and the laws vary a little. California requires it to cover the sale and sharing of personal data. The remaining states generally require it to cover the sale of personal data and targeted advertising, and some extend it to profiling while others exclude it.
The GPC is not intended to serve as a granular cookie preference tool, but at a minimum it has to affect the tracking technologies on the page when it arrives, particularly targeting and marketing tags. I have also seen insurance carriers ask their policyholders to disable all non-essential tracking when the signal is detected, going well beyond that minimum obligation.
Honoring a GPC signal can also reach beyond web tracking. A business may hold and sell personal data about a visitor who is not logged in when the signal arrives, so the request cannot be matched to the data held internally. It is prudent to offer the visitor a way to identify themselves so the opt-out can be fully honored. Where the visitor is logged in with a known identity, the opt-out should flow downstream without further prompting.
What Does Enforcement Look Like?
The first CCPA enforcement action involved UOOMs and the failure to respect them. In August 2022, Sephora paid $1.2 million after the California Attorney General found it was not honoring the GPC signals its customers sent. It is no longer the only example. In September 2025, the California Privacy Protection Agency fined Tractor Supply $1.35 million, and failing to honor opt-out preference signals such as the GPC was one of the violations listed.
For anyone responsible for a website or a US privacy program, the important question is whether the consent platform and the tags behind it correctly identify GPC signals and act on them. Beyond meeting the state requirements, I recommend honoring the GPC everywhere rather than only where the law demands it. It is simpler to configure, easier to test, and it earns trust with the visitors who bothered to turn it on.
Questions
Is the Global Privacy Control the same as Do Not Track?+
No. Do Not Track was a browser signal proposed in 2009 that no law required anyone to honor, so almost nobody did. The Global Privacy Control, developed in 2020, carries a specific legal meaning under twelve state privacy laws, which treat it as a valid opt-out from the sale of personal data and targeted advertising.
Do I need to honor the signal if my state's privacy law does not require it?+
In many cases, yes. The obligation follows the visitor's state of residence, not the business's location. For example, a company in Ohio that meets the thresholds of any of the states with the requirement must honor the signal for residents of those states. Because geolocation only estimates where visitors are, and their state of residence is often unknown, many businesses honor the signal everywhere.
Does a consent banner with an opt-out option satisfy the requirement?+
No. A banner gives visitors a way to declare privacy preferences manually, while UOOM signals such as GPC are delivered automatically. When the signal is delivered and detected, the site has to apply the opt-out immediately, without waiting for a consent banner interaction. A banner can display a message conveying that GPC has been identified and honored, but a banner that ignores the signal until the visitor interacts with it is not meeting its obligations.
Briefings are informational and do not constitute legal advice.
Ready for the regulators?
I'll check your website for privacy law compliance.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.