Treat a qualifying browser or device privacy signal as a sale-or-sharing opt-out, stop covered disclosure as soon as feasibly possible, extend the opt-out to associated profiles, and preserve proof that downstream flows stopped.
The CCPA regulations require businesses that sell or share personal information to process the signal; a privacy link or cookie banner does not replace that duty.
An such as is a technical signal that clearly communicates a consumer's choice to stop sale or sharing of personal information. A business that sells or shares must treat a commonly used, recognized signal as a valid opt-out for the browser or device and every associated consumer profile, including pseudonymous profiles. Do not require identity verification, an account, or extra steps. The signal does not request deletion or stop collection and first-party use by itself.
1
Section 1
How should a GPC Handling Workflow run under the US CPRA?
Detect the signal at every consumer-facing domain, app, and relevant endpoint and stop sale or sharing as soon as feasibly possible. Confirm that the format is commonly used and recognized, such as an HTTP header or JavaScript object, and that the sending mechanism tells consumers the signal opts them out of sale and sharing. The regulations do not condition validity on a California-only disclosure.
Apply the signal to the browser or device and all associated profiles. If the consumer is known, apply it to that consumer, including offline sale or sharing. If the consumer is unknown, do not demand identifying information; optional information may be offered only to extend the request and may be used, disclosed, and retained only to process the opt-out.
A conflicting business-specific setting does not cancel the signal. Honor it, then the business may notify the consumer and seek CCPA-compliant consent. A financial-incentive program may use the regulation's separate confirmation branch. When the consumer is known, the later absence of a signal is not consent to opt back in.
Posting a Do Not Sell or Share link, Alternative Opt-out Link, or privacy-policy form does not excuse signal processing. A business may omit specified links only when it processes signals in a , makes the required privacy-policy disclosures, and the signal fully effectuates online and offline sale-or-sharing opt-outs.
Inventory every sale or sharing path, including tags, pixels, software development kits, identity graphs, ad-tech endpoints, and downstream third parties.
Test signal detection before consent tools initialize and confirm through network and server evidence that blocked recipients receive no personal information after the signal.
Apply the preference to the browser or device and to a known profile when it can be associated with the consumer; do not require verification.
Stop sale or sharing as soon as feasible and no later than 15 business days; notify third parties that received information after the request but before compliance and preserve transmission or suppression evidence.
Record test date, signal value, environment, resulting network behavior, profile state, exceptions, owner, and remediation.
GPC lets users signal their desired privacy, just by browsing
2
Section 2
What fields should the GPC Handling Workflow template capture?
The privacy engineering or consent owner should maintain evidence that the signal was detected, translated into a sale-or-sharing opt-out, applied to the correct scope, propagated downstream, and preserved where the business can recognize the consumer.
Domain, app, environment, browser or device, signal header or API value, capture time, and test owner.
Consent-platform state, tags or SDKs evaluated, sale-or-sharing classification and rationale, blocked and allowed recipients, network evidence, and 15-business-day completion deadline.
Profile association result, known or unknown consumer state, offline scope, account preference, local-state record, third-party instruction, and confirmation.
Business-setting or financial-incentive conflict, consent or affirmation record, frictionless-link eligibility, defect ticket, remediation deadline, regression result, reviewer, and next test date.
Confirms that a qualifying opt-out preference signal, including GPC, is a valid sale-or-sharing opt-out and may be sent through a browser setting or extension.
Businesses must honor opt–out preference signals (“OOPS”) that meet certain requirements, such as the Global Privacy Control
Current official sections 7025 and 7026 support the signal, profile, conflict, confirmation, downstream-notice, and 15-business-day evidence fields.
3
Section 3
How should teams review and improve the GPC Handling Workflow?
Run regression tests after changes to consent software, tag managers, advertising partners, domains, apps, login flows, or identity systems. Test signed-in and signed-out sessions, first visits, cleared storage, multiple browsers, delayed scripts, offline profile propagation, and known-consumer return visits. A visible privacy message does not prove that sale or sharing stopped.
Inventory every current recipient and retest its classification as sale, sharing, service-provider processing, contractor processing, or another disclosed use.
Compare page-load and server-side events with and without the signal; investigate any covered disclosure that occurs before or after the consent layer changes state.
Confirm a known consumer's opt-out survives a later session or device without a signal; do not treat signal absence as opt-in.
Recheck whether frictionless processing fully reaches offline activity before omitting any statutory opt-out link.
Current official sections 7025 and 7026 support regression testing for signal scope, persistence, conflicts, frictionless processing, confirmation, and downstream action.
Recommended next step
Turn US CPRA GPC Handling Workflow into assigned work
This US CPRA guide turns GPC Handling Workflow into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Current official sections 7025 and 7026 govern qualifying signals, browser and profile scope, conflicts, frictionless processing, confirmation, timing, and downstream notice.
Section 7025 governs qualifying opt-out preference signals, browser or device scope, profile association, frictionless processing, and consumer consent.
Current official sections 7025 and 7026 support the signal, profile, conflict, confirmation, downstream-notice, and 15-business-day evidence fields.
Show 1 more
Current official sections 7025 and 7026 support regression testing for signal scope, persistence, conflicts, frictionless processing, confirmation, and downstream action.
Supports this page's GPC Handling Workflow analysis under the US CPRA.
Workflow support for GPC Handling Workflow.
Confirms that a qualifying opt-out preference signal, including GPC, is a valid sale-or-sharing opt-out and may be sent through a browser setting or extension.
Show 1 more
Confirms the consumer-facing GPC rule that businesses must honor qualifying opt-out preference signals for sale and sharing.
"Businesses must honor opt–out preference signals (“OOPS”) that meet certain requirements, such as the Global Privacy Control"