What should teams do about GPC under the US CPRA?
A covered business that sells or shares personal information must treat a qualifying or other as a request to opt out for the browser or device that sends it. The signal must use a format commonly used and recognized by businesses, such as an HTTP header or JavaScript object, and the sending mechanism must make clear that it is meant to opt the consumer out of sale and sharing. If the business knows the consumer, the signal also applies to the consumer and associated profiles, including pseudonymous profiles. The signal is a request made directly by the consumer, so the business cannot require signed authorization or verification.
The business must process the signal even if it also posts a "Do Not Sell or Share My Personal Information" link. It may omit that link only if it meets the separate statutory and regulatory conditions for frictionless processing, including fully effectuating the opt-out and making the required privacy-policy disclosures. Frictionless processing cannot charge a fee, change the product experience, or display an interstitial in response to the signal.
GPC covers sale and sharing. Deletion, correction, access, and sensitive-data limitation use their own request processes. Map the signal to every relevant online sale and cross-context behavioral advertising flow, the associated profile when known, and downstream recipients. Stop sale or sharing as soon as feasibly possible and no later than 15 business days, notify affected third parties for transfers during that period, show a confirmation state, and keep dated logged-in and logged-out tests.
- Test recognized signal formats across browsers, devices, consent tools, tags, server-side transfers, and account states.
- Apply the signal before optional scripts or downstream sale or sharing occurs; do not wait for login to honor the browser or device request.
- Document any conflict with a business-specific privacy setting or financial incentive and follow the specific section 7025 rule rather than silently overriding the signal.
Citations (4)
- California Consumer Privacy Act Regulations (March 2023)
Official CPPA regulations source for opt-out preference signal processing, privacy-choice links, and related CPRA implementation requirements.
Office of Administrative Law approved the California Privacy Protection Agency’s regulations
- California Privacy Protection Agency FAQ
Official CPPA consumer guidance confirming that businesses must honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing opt-outs.
Businesses must honor opt–out preference signals (“OOPS”) that meet certain requirements, such as the Global Privacy Control
- Global Privacy Control project site
The GPC project's public overview explains the browser-level signal and its intended sale-or-sharing preference.
GPC lets users signal their desired privacy, just by browsing
- California Consumer Privacy Act regulations effective January 1, 2026
Current sections 7025 and 7026 support signal qualification, scope, conflict handling, frictionless-processing conditions, response timing, downstream notice, and confirmation.