US CPRA GPC Handling

The duty applies to a business that sells or shares personal information and receives a signal in a format commonly used and recognized by businesses, such as an HTTP header or JavaScript object. The sending platform, technology, or mechanism must make clear to the consumer that the signal opts the consumer out of sale and sharing. A business that does not sell or share personal information is not required to process the signal as an opt-out request.

For this right, a sale is a transfer or other communication of personal information to a third party for money or other valuable consideration. Sharing is a transfer or other communication to a third party for cross-context behavioral advertising, whether or not consideration changes hands. Each definition has specified exclusions, including qualifying consumer-directed and service-provider or contractor disclosures.

Posting a "Do Not Sell or Share My Personal Information" or alternative privacy-choices link does not replace GPC handling. A business that sells or shares personal information online must still process a qualifying opt-out preference signal. A cookie banner alone is not an adequate sale-or-sharing opt-out method because cookie collection and sale or sharing are different questions.

A business may omit the opt-out links only if it processes signals in a frictionless manner and meets every additional condition in section 7025(g), including full effectuation of the request and the required privacy-policy disclosures. Frictionless processing cannot charge a fee, require valuable consideration, change how the product or service functions, or display a pop-up or other interstitial in response to GPC; a neutral processed-status display and a privacy-settings link are allowed. The exception removes only the link requirement; the duty to honor GPC remains.

Apply the signal to the browser or device and every consumer profile, including a pseudonymous profile, that the business associates with it. If the business knows the consumer, such as when the consumer is signed in, apply the opt-out to that consumer as well. That may extend the choice to the account and to offline sale or sharing tied to the known consumer.

Do not make optional identification a condition of honoring the device-level request. The business may invite the consumer to provide information so the request can reach offline records, but information supplied for that purpose may be used, disclosed, and retained only to process the opt-out. If the consumer supplies nothing, the browser-or-device and associated-profile opt-out still applies.

If GPC conflicts with a business-specific setting that allows sale or sharing, process GPC as the opt-out. The business may explain the conflict and offer a consent choice that complies with the regulations. If the consumer validly consents, the business may ignore the signal while that consumer remains known to it.

A financial incentive program has a narrower branch. If participation requires consent to sale or sharing and the consumer is known, the business may ask the consumer to affirm withdrawal from the program. If the consumer does not affirm, the business may ignore GPC only for that known consumer's participation in the program. If the business does not ask, or can no longer identify the consumer, it must process GPC for the browser or device and associated profile. Except where the regulations allow otherwise, wait at least 12 months after an opt-out before asking the consumer to consent to sale or sharing.

Privacy should own the legal classification and notice language; engineering or product should own detection and state propagation; advertising operations should stop covered tags and transfers; vendor management should confirm downstream instructions and contracts. Assign one control owner to reconcile these parts.

Test with GPC on and off, signed in and signed out, on a new device, after cookie clearing, and after a privacy-setting conflict. Evidence should show the received signal, identifiers and profiles in scope, decision time, suppression state, downstream action, and any consumer-facing confirmation. Avoid retaining raw request data beyond what is needed to process and demonstrate the control.