What is GPC and how should teams handle it under the US CCPA?
Process the signal for the browser or device that sends it and every consumer profile, including a pseudonymous profile, associated with that browser or device. If the business knows the consumer, treat the signal as applying to the consumer, their account, and identifiable offline sale or sharing. Do not wait for a separate form, account creation, or identity verification.
A qualifying signal must use a format commonly used and recognized by businesses, such as an HTTP header or JavaScript object, and the sending mechanism must tell the consumer that the signal is meant to opt out of sale and sharing. The regulations do not require the disclosure to mention California. The GPC specification expresses the signal through the Sec-GPC header and the navigator.globalPrivacyControl JavaScript property, but the legal test is section 7025 rather than a product name alone.
If the signal conflicts with a business-specific setting that permits sale or sharing, process the opt-out first. The business may explain the conflict and seek fresh consent through a compliant choice. A financial-incentive conflict has a separate confirmation branch. Absence of the signal on a later visit is not consent to opt in when the consumer is known to the business.
GPC is not a delete request and does not by itself withdraw every form of consent or limit every use of sensitive personal information. Scope it to the CCPA sale and sharing opt-out unless another applicable signal or consumer instruction communicates an additional choice. Stop covered sale or sharing as soon as feasibly possible and no later than 15 business days after receipt.
- Detect the Sec-GPC signal and any other signal that meets the regulatory requirements.
- Apply the opt-out before covered advertising or other sale or sharing occurs.
- Link the status to a known consumer profile when the regulations require it, while avoiding unnecessary identity collection.
- Propagate the choice to tag managers, consent tools, application programming interfaces (APIs), audience systems, data stores, and downstream recipients.
- Disclose in the privacy policy how preference signals are processed, including browser, device, account, and offline scope.
Must a business honor under the CCPA?
A business that sells or shares personal information must process when the signal meets section 7025's format and consumer-disclosure requirements. The business must treat it as a valid request to opt out of sale or sharing for the sending browser or device and associated profiles, including pseudonymous profiles. If the consumer is known, the request also applies to that consumer.
Can a business require a form, login, or identity check before honoring GPC?
No. The business cannot require information beyond what is necessary to send the signal and cannot make the consumer submit a separate form or verifiable consumer request. It may offer an optional way to identify the consumer so the opt-out can reach offline activity, but it must still honor the signal for the browser or device and associated profiles if the consumer provides nothing further.
How far does a GPC opt-out apply?
At minimum, it applies to the browser or device that sent the signal and every profile the business associates with that browser or device. When the consumer is known, it also applies to the consumer, the account, and identifiable offline sale or sharing. A later visit from a device without the signal does not reverse the choice for a known consumer.
What happens when GPC conflicts with an account setting or financial incentive?
For a conflicting account setting that permits sale or sharing, process GPC as an opt-out and use any consent prompt only as the regulations permit. For a financial incentive requiring consent to sale or sharing, the business may ask whether the consumer intends to withdraw. If the consumer affirms, honor the opt-out. If asked but the consumer does not affirm, the business may ignore the signal only for that program while the consumer remains known. If the business does not ask, honor the signal for the browser or device and associated profiles. Display the resulting choice status in either case; section 7025(c)(4) controls this narrow branch.
Does honoring GPC let a business remove its privacy-choice link?
Only if the business meets the statute and section 7025 rules for frictionless processing. It must honor the signal without a fee, degraded experience, or responsive pop-up; explain the practice in its privacy policy; and let the signal fully effectuate the opt-out, including offline sale or sharing when applicable. Otherwise, the business must honor GPC and keep the required Do Not Sell or Share or alternative privacy-choice link.
How quickly must a GPC opt-out take effect?
The business must stop selling or sharing the consumer's personal information as soon as feasibly possible and no later than 15 business days after receiving the request. It must also notify third parties that received the information during the interval between receipt and compliance and direct them to honor and forward the request as required by section 7026.
Citations (3)
- California Civil Code section 1798.135
Binding source for preference-signal options, privacy-policy disclosure, downstream handling, and consumer authorization.
- CPPA CCPA Regulations effective January 1, 2026
Section 7025 defines qualifying signals and the required browser, device, account, conflict, notice, and frictionless processing.
- W3C Privacy Community Group - Global Privacy Control specification
Technical specification for expressing GPC through the Sec-GPC HTTP request header and the JavaScript navigator.globalPrivacyControl property.