Do You Have to Honor Global Privacy Control?

Yes. If the CCPA covers you, honoring the Global Privacy Control browser signal is mandatory, and as of January 1, 2026 the updated regulations go further: section 7025(c)(6) of the approved regulation text now reads that "a business must display whether it has processed the consumer's opt-out preference signal as a valid request to opt-out of sale/sharing on its website," where the previous text said "may." In Colorado, the Attorney General's universal opt-out page states that "currently, the only UOOM considered valid by The Department is GPC" and that businesses within the Colorado Privacy Act's thresholds have had to honor it since July 1, 2024. Connecticut has required it since January 1, 2025. The contrarian part is what this replaces rather than what it adds: the California regulations say plainly that the statute does "not give the business the choice between posting the above-referenced links or honoring opt-out preference signals," so the Do Not Sell link many companies treat as their compliance story was never an alternative to processing the signal.

This article covers what the regulations require, what the three-state enforcement sweep actually asked companies to prove, and the implementation order that gets a real site compliant.

Key takeaways

• Honoring GPC is mandatory in California, and in Colorado GPC is the only mechanism the Attorney General currently recognizes.
• Since January 1, 2026, California requires you to display whether you processed the signal, not merely to process it.
• A Do Not Sell or Share link is not a substitute. The regulations say so directly.
• Ignoring GPC has an enforcement history: the California Attorney General's Sephora settlement in August 2022 rested partly on exactly that failure.
• The browsers themselves are next. California's AB 566 was signed October 8, 2025 and takes effect January 1, 2027.

What the regulation actually requires

Section 7025(b) sets the duty: a business that sells or shares personal information "shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing." The requirements are deliberately low: the signal has to be in a format commonly used and recognized by businesses, such as an HTTP header field or a JavaScript object, and the platform sending it has to make clear to the consumer that using it is meant to opt them out. The regulation adds that the disclosure "does not need to be tailored only to California or to refer to California," which is what makes a generic browser-level signal legally sufficient.

Subsection (c) is where the operational detail lives. On receiving a compliant signal, the business must treat it as a valid opt-out for that browser or device "and any consumer profile associated with that browser or device, including pseudonymous profiles," and, if the consumer is known to the business, for the consumer as well. It must not require the consumer to provide anything beyond what is needed to send the signal. Where the signal conflicts with a business-specific privacy setting that permits selling, the business must process the signal anyway, though it may notify the consumer of the conflict and offer them the chance to consent. And where the consumer is known to the business, the absence of a signal on a later visit must not be read as consent to opt back in.

Then there is the change that took effect January 1, 2026. In the approved text, subsection (c)(6) shows "may" struck through and "must" inserted: a business must display whether it has processed the signal. The regulation's own example is a site displaying "Opt-Out Request Preference Signal Honored" when a browser sending the signal visits, or reflecting the opted-out state through a toggle or radio button. This is a small engineering change and a large evidentiary one, because it converts an invisible backend behavior into something a regulator, a journalist or a competitor can check from the outside in about four seconds.

The link was never an alternative

Section 7025(e) is the paragraph to send to whoever tells you the footer link covers it. It explains that Civil Code section 1798.135 gives a business a choice between, on one hand, processing signals and posting the "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, and on the other, processing signals in a frictionless manner and not posting those links. Then it says the quiet part out loud: those provisions "do not give the business the choice between posting the above-referenced links or honoring opt-out preference signals. Even if the business posts the above-referenced links, the business must still process opt-out preference signals, though it may do so in a non-frictionless manner."

If you want to drop the links, subsection (f) tells you what frictionless costs. You may not charge a fee or require consideration for using the signal; you may not change the consumer's experience with the product or service; and you may not display a notification, pop-up, text, graphic, animation, sound, video or interstitial in response to the signal. There is a carve-out that matters given the new display duty: displaying whether the consumer has opted out is expressly not a violation of that last rule.

Colorado and Connecticut, and why a national posture is simpler

Colorado runs a registry rather than a standard. Under the Colorado Privacy Act rules the Attorney General maintains a public list of recognized universal opt-out mechanisms, and as of August 2026 the Department's own page says GPC is the only one on it, with the recognition obligation running from July 1, 2024. The list "shall be updated periodically," so a Colorado-specific implementation is a thing you have to watch rather than a thing you finish.

Connecticut's Attorney General, in the joint sweep announcement, put it in one line: "all businesses covered by the CTDPA must respond to a consumer's OOPS," with the obligation applying to Connecticut residents as of January 1, 2025.

We are deliberately not giving you a count of how many states now require this. The counts published in vendor content drift every quarter and we could not verify one against a primary source we could read, so instead: honor the signal for every visitor regardless of where they are. Per-state signal logic costs more to build and more to maintain than the thing it saves, and it converts a browser-level control into a geolocation problem you did not need to have. Check the specific states you have consumers in against our US privacy laws resource and against the current Colorado list.

The enforcement record is not theoretical

In August 2022 the California Attorney General announced a settlement with Sephora for 1.2 million dollars in penalties, on allegations including that the company "failed to process user requests to opt out of sale via user-enabled global privacy controls in violation of the CCPA." That is the reference point everyone cites, and it predates the current regulations.

More relevant to what happens next: on September 9, 2025 the California Attorney General, the California Privacy Protection Agency, and the Attorneys General of Colorado and Connecticut announced a joint investigative sweep into failures to honor opt-out rights, aimed specifically at requests sent via GPC. The coalition "sent letters to businesses that do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via the GPC as required by law and requested that those businesses come into immediate compliance."

Read the mechanism there, because it tells you what to build. Regulators identified non-compliant businesses from the outside, by sending a signal and observing the response. Nothing in that method requires a complaint, a subpoena or an insider. It is a crawler.

What is coming: AB 566 moves the burden to browsers

California's Opt Me Out Act, AB 566, was signed on October 8, 2025 and takes effect January 1, 2027. Per the IAPP's report, it requires companies that develop or maintain a web browser to build an opt-out preference signal into the browser so consumers can opt out once instead of on every site.

The practical consequence is a volume change, not a legal one. As of August 2026, GPC ships natively in a handful of privacy-forward browsers and extensions, among them Brave, DuckDuckGo, Firefox, Privacy Badger and Disconnect, and the specification became a W3C Privacy Working Group work item in November 2024. Signal traffic today is a minority of visitors. Once the browsers most people actually use have to offer the setting, the share of your traffic arriving pre-opted-out stops being a rounding error, and any revenue model that quietly depends on low signal adoption gets tested. That is a good reason to measure your current signal rate now, so you can see the change when it arrives.

Implementation, in the order that works

1. Detect. Read the Sec-GPC request header server-side and the globalPrivacyControl JavaScript property client-side. Server-side detection is what lets you avoid loading tags at all rather than loading and then suppressing them.

2. Suppress before load. The signal has to gate tag loading, not fire an opt-out after the pixel has already run. A tag that loads and then opts out has already shared.

3. Propagate. Push the opt-out to your analytics, advertising and CDP vendors through whatever consent mode or restricted-processing flag each one offers, and record that you did. Section 7026 also requires notifying third parties you sold or shared to in the window before you complied.

4. Associate. If the visitor is known to you, apply the opt-out to the account and to offline sale or sharing, not just to the browser. If they are not known, apply it to the browser identifier and any pseudonymous profile tied to it.

5. Display. Render the state. "Opt-Out Preference Signal Honored," or a toggle that reflects the opted-out status, is now required rather than optional.

6. Do not re-ask. Absence of the signal on a later visit is not consent, and where a consumer has opted out the regulations require waiting at least 12 months before asking them to opt back in.

7. Test from outside. Load your own site in a browser with the signal on and watch the network tab. If an advertising request fires, you have your answer.

When you should not hire a consultancy like this one

If you have one website, one analytics tool, no advertising pixels and you genuinely do not sell or share personal information as those terms are defined, this is a half-day of engineering work and a paragraph in your privacy policy. Do not buy a consent management platform for it, and do not buy a privacy programme. Read section 7025, implement detection and suppression, display the state, and write down the analysis that led you to conclude you do not sell or share, because that analysis is the thing a regulator will ask about.

We will also say the unhelpful thing: a consent management platform can implement most of this correctly and many do. What a platform cannot do is tell you whether your particular data flows constitute a sale or a share, whether your enrichment vendor's contract makes them a service provider or a third party, or what to say when a regulator's letter arrives. That is judgment work, and it is a small fraction of the total effort.

Where we earn a fee is the messy middle: a marketing stack nobody has fully inventoried, a data flow that turns out to be a sale under a definition the team had not read, or a business that has already received one of those letters.

Where Top Floor fits

Our CCPA service covers the signal implementation, the display requirement, the sale-or-share analysis underneath it, and the notice language that has to match what the site actually does. Global privacy is where the California work gets extended into a single national posture instead of a per-state one, which is also the cheaper answer once Colorado and Connecticut are in the picture. If you are working through the related question of what banner, if any, you owe US visitors, that is do US websites need a cookie banner, which is the companion piece to this one. Dates and rule changes as they land are tracked on our regulatory radar.

For whatever it is worth as a signal of practice rather than theory: this site honors GPC as an opt-out of advertising trackers regardless of any stored banner preference, and says so in its cookie policy.

How to decide this week

1. Open your site in Brave or Firefox with the signal enabled and watch the network tab. Any advertising or analytics request that fires is a finding.

2. Grep your codebase for Sec-GPC and globalPrivacyControl. If neither appears, you are not detecting the signal and everything downstream is moot.

3. Measure your current signal rate in server logs. You want that baseline before AB 566 changes it.

4. Decide, in writing, whether you sell or share personal information as the CCPA defines those terms, naming each vendor relationship and the conclusion for it.

5. Ship the display requirement. It is the smallest change on this list and the only one that is visible from outside, which makes it the one most likely to be checked.

Frequently asked questions

Is honoring Global Privacy Control legally required or just a best practice?

Required, where the law reaches you. California's regulations state that a business that sells or shares personal information shall process a conforming opt-out preference signal as a valid request to opt out, and the Colorado Attorney General's office identifies GPC as currently the only universal opt-out mechanism it recognizes, with recognition required since July 1, 2024. Connecticut's Attorney General has stated that all businesses covered by the CTDPA must respond to such signals, which took effect for Connecticut residents on January 1, 2025.

We have a Do Not Sell link in the footer. Is that enough?

No, and the California regulations address this directly. Section 7025(e) explains that the statute does not give a business the choice between posting the opt-out links and honoring opt-out preference signals, and that even a business posting those links must still process the signals, though it may do so in a non-frictionless manner. The choice the statute actually offers runs the other way: a business that processes signals in a frictionless manner may skip the links.

What changed on January 1, 2026?

The display duty. In the approved regulation text, section 7025(c)(6) previously said a business may display whether it has processed the consumer's opt-out preference signal, and the approved text strikes "may" and inserts "must," so the disclosure is now mandatory. The regulation's own examples are displaying wording such as "Opt-Out Request Preference Signal Honored" or reflecting the opted-out state in a toggle or radio button, and displaying that state is expressly not treated as the kind of interstitial response that would break the frictionless conditions.

Do we have to honor the signal for visitors outside California and Colorado?

Not necessarily as a matter of law, but building per-state signal logic usually costs more than it saves. Deciding whether to honor a browser-level signal on the basis of an IP-derived location means adding a geolocation dependency, maintaining it as more states adopt requirements, and accepting the failure mode where the location lookup is wrong. Honoring the signal for everyone is one code path, it is defensible in every jurisdiction, and it removes the state-count question from your engineering backlog entirely.