We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSGPC

US CCPA GPC

Treat a qualifying signal as a request to opt out of , apply it without identity verification or avoidable friction, and propagate the choice to affected systems and recipients.

For engineering, advertising, privacy, vendor, and assurance teams connecting a received signal to actual suppression and consumer-visible status.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections4 primary sources
Overview

A qualifying (GPC) signal is a CCPA request to opt out of sale and sharing for the browser or device that sends it and for any associated consumer profile, including a pseudonymous profile. A business must process the signal without requiring identity verification. This guide covers detection, scope, account propagation, conflicts, downstream action, and evidence.

Section 1

How should teams handle Global Privacy Control signals under the US CCPA?

Detect the signal at every consumer-facing online property where the business sells or shares personal information. Confirm that the format is commonly used and recognized and that the sending mechanism tells the consumer it is intended to opt out of sale and sharing. Apply it to the browser or device and every associated known or pseudonymous profile. If the consumer is known, the business must also apply the choice to the consumer, including the known account and applicable offline .

Do not require confirmation or identifying information before honoring the signal. The business may offer an optional way to identify the consumer to extend the opt-out to otherwise unmatched offline activity, but must honor the browser or device and associated-profile scope even without a response. Display on the website whether the signal was processed as an opt-out without turning that status display into a barrier.

  • Read the Sec-GPC signal value defined by the GPC specification and treat a value of 1 as the consumer's opt-out preference.
  • Stop covered sale and sharing for the affected browser, device, and associated profiles.
  • Propagate the choice to consent management, advertising, audience, analytics, identity, and downstream-recipient controls.
  • Keep the do-not-sell-or-share method available unless the business qualifies for the regulations' frictionless-processing alternative.
Section 2

Assign signal, disclosure, and test owners

Engineering owns reliable detection and propagation; privacy or legal maps the signal to sale and sharing decisions; advertising and vendor owners stop covered disclosures; and quality or compliance tests the complete path.

Keep request timestamps, signal values, affected domain and device context, profile or account propagation results, vendor instructions, and tests showing that covered tags or transfers stop. Avoid storing more personal information than needed to prove the control.

  • Test anonymous and logged-in states, first visit and return visit, each supported browser, and every domain or app surface in scope.
  • Verify that the signal reaches server-side and third-party integrations, not only the visible cookie banner.
  • Record any data flow classified as outside and the facts supporting that conclusion.
  • Retest after tag-manager, consent-platform, identity, advertising, or account-linking changes.
Section 3

Resolve account and financial-incentive conflicts

If a qualifying signal conflicts with a business-specific setting allowing , honor the signal first. The business may notify the consumer of the conflict and offer consent that meets section 7004 and the applicable repeat-consent rules. A financial-incentive conflict follows the narrower section 7025(c)(4) branch; record its specific outcome and display the resulting choice status.

A GPC signal expresses the right to opt out of sale and sharing. It does not by itself submit a request to delete, correct, know, or limit sensitive-personal-information use. Those rights need their own intake and handling paths.

  • Do not treat absence of a signal as consent to for a consumer under 16.
  • Do not limit processing to conventional cookies when server-side identifiers, pixels, software development kits (SDKs), or account audiences also support .
  • Do not require a California IP address before honoring a qualifying signal for a known California consumer.
  • Review whether a first-party or service-provider label matches the actual contract and use; role names alone do not remove a disclosure from .
Section 4

Trace a test signal through every recipient

Trace one test signal from the HTTP request through every decision point and recipient. The result should show which transfers were suppressed, how the preference was stored, whether it reached an associated account, and what the consumer saw.

Treat a passed banner test as incomplete if network, server, audience, or vendor logs show that covered continued.

  • Detect and log the qualifying signal without collecting unnecessary identity data.
  • Resolve the browser, device, pseudonymous profile, and logged-in account scope.
  • Suppress covered sale and sharing and notify affected recipients or systems.
  • Display whether the signal was processed as an opt-out, then retain a dated end-to-end test record.
Recommended next step

Turn US CCPA GPC into assigned work

Assign owners for signal detection, identity scope, suppression, displayed status, recipient instructions, and end-to-end tests.

Assessment workflow
Open Assessment Autopilot for US CCPA

Turn GPC into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CCPA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

California Civil Code section 1798.135
leginfo.legislature.ca.gov5 citations
Referenced sections
  • Binding statutory source for opt-out preference signals and the frictionless-processing alternative.
  • Binding source for opt-out preference signals and the conditions for the frictionless-processing alternative.
  • Binding source for honoring opt-out preference signals.
Show 2 more
  • Binding source for the signal requirement and statutory frictionless-processing conditions.
  • Binding source for opt-out preference signal processing and implementation evidence.
"opt-out preference signal"
California Privacy Protection Agency FAQ
cppa.ca.gov3 citations
Referenced sections
  • Non-binding CPPA FAQ explains that qualifying opt-out preference signals, including GPC, operate as CCPA sale/sharing opt-out requests.
  • Non-binding CPPA FAQ explains that businesses must honor qualifying opt-out preference signals, such as Global Privacy Control, as sale/sharing opt-out requests.
  • Non-binding CPPA FAQ explains that opt-out preference signals such as GPC can operate as valid CCPA opt-out requests.
"Businesses must honor opt–out preference signals (“OOPS”) that meet certain requirements, such as the Global Privacy Control"
California Attorney General: Global Privacy Control
oag.ca.gov2 citations
Referenced sections
  • Official California guidance explaining GPC's status as a proposed technical standard and its legal effect under the CCPA.
"It is a proposed technical standard that reflects what the CCPA regulations contemplated"
More quoted passages
"Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information."

Related guides

CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence

Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.

CCPA Contract Classification: Service Provider or Third Party?

Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.

CCPA Deadlines and Compliance Calendar

Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.

CCPA Do Not Sell or Share Guide

Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.

CCPA Do Not Sell or Share: Implementation and Testing

Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.

CCPA DSAR Workflow: Intake, Verification, and Response

Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.

Show all related guides (44)

CCPA Opt-Out Signal Workflow: Detect, Apply, and Test GPC

Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.

CCPA Penalties and Fines: Current Amounts

See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.

CCPA Privacy Policy Template: Required Content and Review

Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.

CCPA Risk Assessments, Cybersecurity Audits, and ADMT

Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.

CCPA vs CPRA: What Changed and Which Rules Apply

Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.

CCPA vs GDPR: Scope, Rights, Duties, and Evidence

Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.

US CCPA Applicability Test Guide

Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.

US CCPA Compliance Checklist

A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.

US CCPA Compliance Guide

Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.

US CCPA Dark Patterns Guide

Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.

US CCPA Data Broker Crossover Guide

Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.

US CCPA DSAR Verification Guide

Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.

US CCPA Enforcement and Penalties Guide

Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.

US CCPA Financial Incentives Guide

Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.

US CCPA Minors Guide

Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.

US CCPA Notice at collection Guide

Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.

US CCPA Personal and Sensitive PI Categories Guide

Classify CCPA personal information and sensitive personal information, apply exclusions, and map each category to notices, rights, retention, security, sale, and sharing.

US CCPA Privacy Law FAQ

Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.

US CCPA Privacy Notices and Disclosures Guide

Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.

US CCPA Privacy Policy Guide

Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.

US CCPA Requirements Guide

Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.

US CCPA Scope and Thresholds Guide

CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.

US CCPA Service Provider Contractor and Third Party Contracts Guide

Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.

US CCPA Service Provider Contractor Contracts Guide

Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.

US CCPA Thresholds Guide

Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.

California Data Brokers: CCPA, Registration, and DROP Duties

Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.

CCPA Dark Patterns: Rules, Examples, and Review Checklist

Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.

CCPA Do Not Sell or Share: Scope and Implementation

Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.

CCPA Financial Incentives: Notice, Consent, and Data Value

Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.

CCPA Global Privacy Control (GPC): team obligations and technical implementation

Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.

CCPA Minors: Opt-In Rules for Consumers Under 16

Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.

CCPA Notice at Collection: Timing, Content, and Examples

Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.

CCPA Personal and Sensitive Information Categories

Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.

Does the CCPA apply to my business? Threshold guide

Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.

What must a CCPA privacy policy include?

A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.

What must CCPA service-provider contracts include?

Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.

What should teams do about consumer request verification under the CCPA?

Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.

When does the CCPA require risk assessments or cyber audits?

CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.