Set a preference once. Your browser can tell the sites you visit that you want to opt out of selling or sharing your data.
The signal is called GPC. What a site must do with it depends on the applicable law.
TRY AN EXAMPLE
One signal. Three state laws.
A customer visits a lemonade delivery site. The site sells customer data and uses it for advertising across other sites. What happens when the customer sends GPC?
Assume an adult resident and a business covered by the selected law, with no later valid consent or incentive-program conflict. This example does not change your browser settings.
01 / CUSTOMER’S BROWSER
↗
Opt-out signal sent
The customer’s preference travels with the visit.
SIMULATION
02 / CALIFORNIA BUSINESS
Stop sale and sharing.
Process the signal as an opt-out of the sale and sharing of personal information. “Sharing” includes cross-context behavioral advertising.
No signal is not consent.
The signal’s absence does not authorize sale or sharing. Keep honoring an existing opt-out; other legal restrictions still apply.
11 CCR § 7025(b), (c)(1), (c)(5)
What must the business do?
Apply the opt-out to this browser or device and its associated profiles; if the consumer is known, also apply it to the consumer.
Display whether the signal was processed. California’s 2026 rule makes that disclosure mandatory. 11 CCR § 7025(c)(6)
A conflicting site preference does not automatically defeat GPC. The rule allows a later valid consent, with required disclosures, and separately addresses financial incentives. 11 CCR § 7025(c)(3)
Honor GPC as an opt-out of the sale of personal data and processing for targeted advertising. Colorado recognizes GPC as a universal opt-out mechanism; acceptance became mandatory on July 1, 2024.
No signal is not consent.
Do not treat a missing signal as permission to resume sale or targeted advertising after an opt-out. Consent requirements and other restrictions still apply.
§ 6-1-1306(1)(a)(IV)(B)
What must the controller do?
Under Rule 5.08, apply a valid opt-out to the associated browser or device and, if known, the consumer. Keep honoring it until the consumer gives valid consent.
A later consent can take precedence, but it requires clear notice and an equally easy way to revoke it. § 6-1-1306(1)(a)(IV)(C)
The privacy policy must explain how universal opt-out requests are handled.
Honor a qualifying signal as an opt-out of the sale of personal data and processing for targeted advertising. Connecticut’s signal requirement began January 1, 2025; its Attorney General identifies GPC as an example.
No signal is not consent.
Nothing here supplies consent or cancels a prior opt-out. The controller must still honor the consumer’s choices and comply with other processing restrictions.
Reader § 42-520(c)(1)(A)(ii)
What must the controller do?
The mechanism must reflect the consumer’s affirmative choice and enable the controller to determine residency and legitimacy, among other statutory conditions.
If the signal conflicts with an existing privacy setting or loyalty-program choice, comply with it. The controller may explain the conflict and ask the consumer to confirm that earlier choice. § 42-520(c)(1)(B)
Citations follow the assigned reader’s amendments through October 1, 2026. Earlier code editions number this duty differently.
GPC exercises an opt-out right. Consent requirements, exceptions and the law’s coverage still matter.
Does GPC reject every cookie or delete my data?
No. It is not a universal “reject all cookies” button or a deletion request. It does not prohibit every use of data, such as processing needed to deliver an order. The state’s definitions of sale, sharing and targeted advertising set the boundaries.
A GPC signal also does not supply consent for sensitive-data processing or other activities that require affirmative permission. See the Colorado and Connecticut consent flows.
Reload this page after changing the setting. The browser check above is separate from the simulation.
How does a website receive it?
A supporting browser sends the HTTP request header Sec-GPC: 1. Page scripts can read navigator.globalPrivacyControl: true reports an active signal; false reports no active signal. If the property is unavailable, this page cannot read it.
A browser check is only an observation. Implementing a legal opt-out also means applying the choice to actual data uses and disclosures. The technical specification is a W3C Working Draft ↗.
Sources, editions & scope
This guide compares three states already covered on Law Vision. Other jurisdictions also recognize privacy signals; this is not a complete list.
State definition and provision popovers use the same assigned-reader excerpts as the Colorado and Connecticut guides. California popovers use the published 2026 statute and regulations. Explanations and examples are editorial. Sources checked October 8, 2026.