dataduty.law

Consumer privacy · Explainer

Honoring Global Privacy Control and other opt-out signals

What California requires when a visitor's browser sends an opt-out preference signal, what changed on January 1, 2026, and the browser mandate coming in 2027.

Last reviewed

In short

  • If you sell or share personal information, a qualifying browser signal such as Global Privacy Control (GPC) is an opt-out request.
  • Apply it to the browser or device, and to the consumer's account if you know who they are.
  • Since January 1, 2026, you must display whether you honored it.
  • From January 1, 2027, browsers must offer consumers a setting to send the signal.

What an opt-out preference signal is

An opt-out preference signal is a setting in a browser, extension or device that tells every website the consumer visits that they opt out of the sale and sharing of their personal information. GPC is the best-known example. It is sent as an HTTP header and exposed to scripts on the page.

Under the regulations, a signal qualifies if it is in a commonly used format, such as an HTTP header field or JavaScript object, and the platform sending it makes clear to the consumer that it is meant to opt them out (11 CCR § 7025(b)).

What you must do

  • Treat it as a valid opt-out for the browser or device, for any profile associated with it (including pseudonymous profiles), and for the consumer if known. Don't require more information before acting on it (11 CCR § 7025(c)(1)–(2)).
  • Let the signal win conflicts. If the signal conflicts with a consumer's privacy settings or their participation in a financial incentive program, follow the signal. You may notify the consumer and ask them to consent to sale or sharing (11 CCR § 7025(c)(3)–(4)).
  • Display the result. Since January 1, 2026 you must display whether you processed the signal as a valid opt-out. The regulation's example is a message such as "Opt-Out Request Honored" (11 CCR § 7025(c)(6)).
  • Describe it in your privacy policy. Explain how you process opt-out preference signals (11 CCR § 7011(e)).
  • Offer another method as well. A business that collects personal information online must accept opt-outs through signals and at least one other method (11 CCR § 7026(a)(1)).

Changed January 1, 2026: the 2025 regulations changed "may display" to "must display" for signal status, and "may" to "must" for giving consumers a way to confirm that opt-out and limit requests were processed (11 CCR §§ 7025(c)(6), 7026(g), 7027(h)).

Across devices and services

In February 2026 the Attorney General announced a $2.75 million settlement with Disney over opt-outs, including GPC, that Disney applied only to a single device or service even when the consumer was logged in. The Attorney General's message: businesses can't make people opt out device by device or service by service. If you know who the consumer is, apply the opt-out to their account.

Coming January 1, 2027: browsers must offer the signal

AB 566 (2025), the California Opt Me Out Act, added Civil Code § 1798.136. From January 1, 2027, a business may not develop or maintain a browser that lacks a consumer-configurable setting to send an opt-out preference signal, and the setting must be easy for a reasonable person to find and configure. Expect many more visitors to arrive with the signal turned on.

How to test your site

  1. Turn on GPC in a browser that supports it, or install an extension that sends it.
  2. Visit your site and confirm the site displays that the opt-out was honored.
  3. Check that advertising and "sharing" tags don't fire, or fire in a restricted mode your contracts support.
  4. Log in and confirm the opt-out attaches to the account, then log in from a second device and confirm it's still in effect.
  5. Repeat after every change to your tag manager or consent platform.

Official sources