Artifact GuideUSGPC

US CPRA GPC

GPC is a browser or device signal that tells a business a consumer wants to opt out of sale or sharing. Under the US CPRA, teams need to know when that signal applies and how to honor it.

This page offers practical steps for implementation planning. Confirm legal and policy assumptions before implementation.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
May 9, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
5

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated May 9, 2026
Overview

This page explains what Global Privacy Control means under the US CPRA and how teams should respond when a covered business receives an opt-out preference signal. It focuses on the practical steps, evidence, and review path that product, legal, privacy, security, and compliance teams can apply.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

What should teams do about GPC under the US CPRA?

Teams should treat GPC under the US CPRA as a source-linked operating decision: confirm whether the issue affects threshold status, sensitive personal information, sharing or cross-context advertising, GPC, correction rights, data-broker duties, ADMT, risk assessments, cybersecurity audits, or service-provider contracts, assign the team that can change the process, and keep evidence showing the action and review trigger.

The safest first step is to identify the data category, consumer-facing interaction, sale/share status, sensitive personal-information issue, and vendor role before assigning the CPRA action.

  • Write the GPC decision in one sentence before drafting controls.
  • Attach the external source URL and a short source quote to the evidence record.
  • Route unclear cases to legal, privacy, security, or compliance review before launch.
Citations
California Privacy Protection Agency FAQ

Official CPPA consumer guidance confirming that businesses must honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing opt-outs.

Question 2

What evidence should teams keep for GPC under the US CPRA?

Useful evidence is not just a privacy policy. Keep the source, threshold notes, request logs, GPC test evidence, notice screenshots, vendor terms, retention logic, and approval trail together.

  • Source URL and quote used for the decision.
  • Scope notes, screenshots, data-flow or system references, and role mapping.
  • Implementation ticket, approval record, exception notes, and review date.
Citations
California Privacy Protection Agency FAQ

Official CPPA consumer guidance confirming that businesses must honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing opt-outs.

Question 3

Which mistakes create risk when handling GPC under the US CPRA?

The common failure pattern is treating every California privacy issue as a generic CCPA notice update instead of checking CPRA amendments, sharing, sensitive data, GPC, and phased CPPA rulemaking.

  • Using an old threshold, deadline, source page, or contract template without checking current source text.
  • Treating a source-linked exception as a general exemption for every product or data flow.
  • Publishing notices, controls, or answers that do not match the actual product behavior.
Citations
California Privacy Protection Agency FAQ

Official CPPA consumer guidance confirming that businesses must honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing opt-outs.

Recommended next step

Turn US CPRA GPC into assigned work

This US CPRA guide turns turn GPC into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow
Open Assessment Autopilot for US CPRA

Turn GPC into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CPRA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

California Consumer Privacy Act Regulations (March 2023)
cppa.ca.gov
Referenced sections
  • Official CPPA regulations source for opt-out preference signal processing, privacy-choice links, and related CPRA implementation requirements.
"Office of Administrative Law approved the California Privacy Protection Agency's regulations"
California legislative bill text
leginfo.legislature.ca.gov
Referenced sections
  • Risk and boundary support for the FAQ answer.
"(ii) Does not make use of any dark patterns"
California Privacy Protection Agency FAQ
cppa.ca.gov
Referenced sections
  • Official CPPA consumer guidance confirming that businesses must honor qualifying opt-out preference signals, including Global Privacy Control, for sale/sharing opt-outs.
"Businesses must honor opt-out preference signals ("OOPS") that meet certain requirements, such as the Global Privacy Control"
CPPA privacy rights guidance
globalprivacycontrol.org
Referenced sections
  • Risk and boundary support for the FAQ answer.
"GPC lets users signal their desired privacy, just by browsing"
Related guides

Explore more topics

California CPRA Checklist
Practical guidance for the California CPRA checklist, with practical decisions, evidence, edge cases, and external source citations.
California CPRA FAQ
Practical California CPRA FAQ guidance with implementation decisions, evidence, edge cases, and official California source citations.
California CPRA penalties and fines Guide
US CPRA guidance for penalties and fines, with practical decisions, evidence, edge cases, and external source citations.
California CPRA Requirements Guide
Practical guidance for California CPRA requirements, with practical decisions, evidence, edge cases, and external source citations.
California CPRA Risk Assessments, Cybersecurity Audits, and ADMT Guide
California CPRA guidance for risk assessments, cybersecurity audits, and ADMT, with practical decisions, evidence, edge cases, and external source citations.
California Data Broker Deletion Workflow Guide
California Delete Act and CPRA-adjacent guidance for data broker deletion workflows, with practical decisions, evidence, edge cases, and official citations.
California Data Broker Registry and DROP Guide
California Delete Act guide to the Data Broker Registry and DROP, with practical decisions, evidence, edge cases, and official source citations.
California Delete Act data broker registry and DROP guide
California Delete Act guidance for the data broker registry and Delete Request and Opt-Out Platform (DROP), with owners, evidence, and official sources.
CPRA enforcement advisories: CPPA investigations, fines, and risk mitigation
US CPRA guidance for Enforcement Advisories, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Applicability Test Guide
Practical guidance for the US CPRA applicability test, with practical decisions, evidence, edge cases, and external source citations.
US CPRA CCPA vs CPRA Guide
US CPRA guidance for CCPA vs CPRA, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Compliance Guide
Practical guidance for the US CPRA compliance, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Consumer Rights Workflow Guide
US CPRA guidance for Consumer Rights Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Contract Terms Guide
US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Contracts Contractors And Service Providers Guide
US CPRA guidance for Contracts Contractors And Service Providers, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Correction Rights Guide
US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Cppa Regulations Tracker Guide
US CPRA guidance for Cppa Regulations Tracker, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Cyber Audit Readiness Workflow Guide
US CPRA guidance for Cyber Audit Readiness Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Deadlines and Compliance Calendar Guide
US CPRA guidance for Deadlines and Compliance Calendar, with practical decisions, evidence, edge cases, and external source citations.
US CPRA DSAR And Correction Workflow Guide
US CPRA guidance for DSAR And Correction Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA GPC Handling Guide
US CPRA guidance for GPC Handling, with practical decisions, evidence, edge cases, and external source citations.
US CPRA GPC Handling Workflow Guide
US CPRA guidance for GPC Handling Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Retention Guide
US CPRA guidance for Retention, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessment Intake Workflow Guide
US CPRA guidance for Risk Assessment Intake Workflow, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessment Template Guide
US CPRA guidance for CPRA Risk Assessment Template, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Risk Assessments And Cybersecurity Audits Guide
US CPRA guidance for Risk Assessments And Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sensitive Personal Information Guide
US CPRA guidance for Sensitive Personal Information, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sensitive Personal Information Limits Guide
US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations.
US CPRA Sharing and Cross-Context Behavioral Advertising Guide
US CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations.
US CPRA vs Colorado Privacy Act Guide
US CPRA guidance for CPRA vs Colorado Privacy Act, with practical decisions, evidence, edge cases, and external source citations.
US CPRA vs Virginia Vcdpa Guide
US CPRA guidance for CPRA vs Virginia Vcdpa, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about ADMT under the US CPRA?
US CPRA guidance for ADMT, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Contract Terms under the US CPRA?
US CPRA guidance for Contract Terms, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Correction Rights under the US CPRA?
US CPRA guidance for Correction Rights, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Cybersecurity Audits under the US CPRA?
US CPRA guidance for Cybersecurity Audits, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about retention under the California CPRA?
California CPRA guidance for retention, including data minimization, privacy policy disclosures, evidence records, and official source citations.
What should teams do about Risk Assessments under the US CPRA?
US CPRA guidance for Risk Assessments, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Sensitive Personal Information Limits under the US CPRA?
US CPRA guidance for Sensitive Personal Information Limits, with practical decisions, evidence, edge cases, and external source citations.
What should teams do about Sharing and Cross-Context Behavioral Advertising under the California CPRA?
California CPRA guidance for Sharing and Cross-Context Behavioral Advertising, with practical decisions, evidence, edge cases, and external source citations.