Treat a qualifying Global Privacy Control signal as a request to opt out of sale or sharing, apply it without identity verification or avoidable friction, and propagate the choice to affected systems and recipients.
Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.
Structured answer sets in this page tree.
Cited legal and guidance references.
A qualifying (GPC) signal is a CCPA request to opt out of sale and sharing for the browser or device that sends it and for any associated consumer profile, including a pseudonymous profile. A business must process the signal without requiring identity verification. This guide covers detection, scope, account propagation, conflicts, downstream action, and evidence.
Detect the signal at every consumer-facing online property where the business sells or shares personal information. Confirm that the format is commonly used and recognized and that the sending mechanism tells the consumer it is intended to opt out of sale and sharing. Apply it to the browser or device and every associated known or pseudonymous profile. If the consumer is known, the business must also apply the choice to the consumer, including the known account and applicable offline .
Do not ask the consumer to confirm the signal or provide identifying information. The signal must work even when the business cannot identify the person. The business must display on its website whether it processed the signal as an opt-out, but the status display cannot become a barrier to the request.
Engineering owns reliable detection and propagation; privacy or legal maps the signal to sale and sharing decisions; advertising and vendor owners stop covered disclosures; and quality or compliance tests the complete path.
Keep request timestamps, signal values, affected domain and device context, profile or account propagation results, vendor instructions, and tests showing that covered tags or transfers stop. Avoid storing more personal information than needed to prove the control.
When a consumer later gives consent that conflicts with the GPC signal, do not silently override the signal. The regulations require the business to explain the conflict and ask whether the consumer intends to consent to .
A GPC signal expresses the right to opt out of sale and sharing. It does not by itself submit a request to delete, correct, know, or limit sensitive-personal-information use. Those rights need their own intake and handling paths.
Trace one test signal from the HTTP request through every decision point and recipient. The result should show which transfers were suppressed, how the preference was stored, whether it reached an associated account, and what the consumer saw.
Treat a passed banner test as incomplete if network, server, audience, or vendor logs show that covered continued.
This US CCPA guide turns GPC into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn GPC into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information."
"opt-out preference signal"
"On March 29, 2023, the Office of Administrative Law approved the California Privacy Protection Agency’s regulations and filed"
"Businesses must honor opt–out preference signals (“OOPS”) that meet certain requirements, such as the Global Privacy Control"