Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Our Opt-Out and GPC Readiness Guide explains how Global Privacy Control works, where universal opt-out signals are required, what California’s rules and draft amendments demand, the ten ways websites fail, a 15-minute self-test, and a six-week plan before browsers must offer the signal on January 1, 2027. Read all 18 pages below.
Compliance Guide · Edition 01The Opt-Out &
GPC Readiness
Guide
How to detect, honor and prove every opt-out signal your website receives, before California’s browser mandate puts one in front of millions more visitors on January 1, 2027.
The guide
The opt-out is the most enforced privacy control in America.
Almost every major California privacy settlement of the last four years came back to one question: when someone said “don’t sell or share my data,” did the business actually stop? Global Privacy Control turned that question into something a regulator can test from a laptop in about a minute.
From January 1, 2027, California requires browsers to give people a built-in way to send that signal. More signals will hit your site, and every one is an opt-out you’re legally required to honor. This guide shows how to make sure you do, and how to prove it.
The 60-second answer
If your site runs ad pixels, retargeting, or shares data with ad partners, a GPC signal must switch that off for the visitor, and for their account if you know who they are. A cookie banner alone doesn’t do this. Test it today using page 8.
This guide is general information, not legal advice.
2027 changes the math
Until now, sending GPC took effort: a privacy-focused browser or an extension. That’s ending. Three things are converging at once.
Browsers must offer it
California’s Opt Me Out Act (AB 566), signed October 8, 2025, requires browsers to let Californians send an opt-out preference signal from January 1, 2027. Browsers that didn’t offer one natively will have to.
California is tightening them
On November 6, 2026, CalPrivacy voted 5-0 to start formal rulemaking on opt-out signals. The draft names GPC, adds worked examples, and would require sites to show whether a signal was honored.
Regulators test the flow
Sephora, Honda, Todd Snyder, Healthline, Tractor Supply, Disney and Lyft all paid California penalties tied to opt-outs that didn’t work as promised.
The real shift
Today, GPC users are a small, privacy-minded slice of your traffic. In 2027, any Californian who flips one browser setting becomes one. A broken opt-out stops being an edge case.
Fifteen minutes on page 8 tells you whether you have a problem.
Include hard-coded pixels and server-side conversion APIs.
Someone in marketing ops and someone in engineering, not just legal.
How GPC actually works
GPC is not a cookie and not a banner choice. It’s a signal the browser sends with every request, in two forms your site can read.
What the signal means
- An opt-out of the sale and sharing of personal information (California)
- An opt-out of targeted advertising and sale in most other states that require it
- It applies automatically: no click, no form, no verification
What it doesn’t mean
- It isn’t “reject all cookies.” Strictly necessary and many first-party analytics cookies can stay, subject to other laws
- It isn’t a reason to show more banners or ask the person to confirm
- It doesn’t expire when the session ends for a known user
You can see the signal yourself: in a GPC-enabled browser, open the developer console on any page and type navigator.globalPrivacyControl. It returns true.
Where the signal is the law
California has required businesses to honor opt-out preference signals since its 2021 regulations. Since then, most new state privacy laws have added a universal opt-out mechanism requirement of their own.
| State | Signal opts the person out of |
|---|---|
| California | Sale and sharing (cross-context behavioral advertising) |
| Colorado | Sale and targeted advertising. GPC is the recognized mechanism |
| Connecticut | Sale and targeted advertising |
| Texas | Sale and targeted advertising |
| Oregon, Montana, Delaware | Sale and targeted advertising |
| New Jersey, Minnesota | Sale and targeted advertising (Minnesota adds profiling) |
| New Hampshire, Maryland, Nebraska | Sale and targeted advertising |
| More coming | Newer laws, including Vermont’s, add signal requirements over the next few years |
Effective dates and details vary by state and some are phased. Check each statute and regulator guidance for current dates.
Simplest compliant approach
Honor GPC everywhere, for everyone. Geo-targeting the signal by state adds complexity, can fail on VPNs and travel, and saves little. Most of our clients now treat GPC as a national opt-out.
Signals cover browsers. You still need a “Do Not Sell or Share” link (California) or an opt-out link for targeted ads, plus a way to opt out by other methods. See page 11.
What “honoring” requires
California’s regulations are the most detailed, and the draft amendments CalPrivacy advanced in November 2026 spell out more. Build to these and you’ll cover the other states.
- Treat the signal as a valid opt-out of sale and sharing for that browser or device
- Also apply it to any consumer profile associated with the browser, including pseudonymous profiles
- If you know who the consumer is, apply it to them, not just the device
- Process it in a frictionless way: no extra pop-ups, fees or requests for information
- Don’t treat a later visit without the signal as permission to resume for a known consumer
- Names an HTTP header like GPC as an example signal format
- Requires showing whether the signal was processed, e.g. “Opt-Out Request Honored” with a toggle in the opt-out state
- If a signal conflicts with a site setting that allows sale or sharing, the signal wins. You may ask for consent, without dark patterns
- Wait 12 months before asking a logged-in user to opt back in
- Adds worked examples for browsers, devices, accounts and offline data
Draft text dated October 8, 2026. A 45-day comment period follows the board’s vote; the text may change before adoption.
✓ Opt-Out Request Honored
We detected a Global Privacy Control signal from your browser. We’ve turned off the sale and sharing of your personal information and targeted advertising for this browser[ and your account].
When choices conflict
| Situation | What to do |
|---|---|
| GPC on, but user once clicked “Accept all” | The signal wins. You may ask for consent to sell or share, without pressure or dark patterns. |
| Known user returns without GPC | Keep the opt-out. A missing signal isn’t permission to resume. |
| User opted in to a loyalty program | Explain any financial incentive clearly. The signal still opts them out of sale and sharing unless they consent again. |
Ten ways sites fail
These are the patterns we see most often when we scan websites. Most sites that fail have several at once.
| # | Failure | What it looks like |
|---|---|---|
| 1 | The CMP ignores GPC | The consent tool is installed, but signal detection is switched off or not supported. |
| 2 | Tags fire before the check | Ad pixels load in the page head before the CMP reads the signal. The first page view leaks. |
| 3 | Hard-coded pixels | Pixels added directly to the site template bypass the tag manager and the CMP entirely. |
| 4 | Server-side leaks | Conversion APIs and server-side tagging keep sending events after the browser pixel is blocked. |
| 5 | Account not updated | A logged-in user’s browser is opted out, but their CRM record and email audiences aren’t. |
| 6 | The opt-out doesn’t stick | The choice is lost on the next visit, on another subdomain, or after cookies clear. |
| 7 | Asking them to undo it | A banner appears asking GPC users to “accept all,” or the opt-out is quietly reversed. |
| 8 | Partners never hear about it | No opt-out flag is passed to ad tech vendors, so they keep treating the user as opted in. |
| 9 | Only some properties covered | The main site honors GPC; the store, blog, app web views or landing pages don’t. |
| 10 | No record | The business can’t show when signals were received or what happened next. |
Test your site in 15 minutes
You don’t need special tools. A GPC-enabled browser and its developer tools will show you what a regulator would see.
Pass looks like
No ad network requests, no ad cookies, a visible “opt-out honored” status, and the same result on every page and subdomain.
Captain Compliance’s scanner runs these checks across your site and flags every tag that fires for a GPC visitor. Start free at captaincompliance.com/cookie-scanner.
Fix the plumbing
Honoring GPC is a pipeline, not a setting. The signal has to reach every place where personal information leaves your systems for advertising.
Order of operations
- Load the consent layer first, before any marketing tag
- Default ad tags to blocked until allowed, not allowed until blocked
- Move hard-coded pixels into the tag manager so the CMP can control them
- Store the opt-out in a first-party cookie or local storage, and re-read the signal on every page
Server and data side
- Read Sec-GPC at the edge or server and attach an opt-out flag to events
- Make conversion APIs and data pipelines drop or restrict flagged events
- Write the flag to the customer record when someone logs in or identifies themselves
- Exclude flagged records from ad audience uploads and data sales
if (navigator.globalPrivacyControl === true || request.header[“Sec-GPC”] === “1”) {
set consent: sale = off, sharing = off, targeted_ads = off
block ad tags · flag server events · if logged in, flag the account
show “Opt-Out Request Honored”
}
Logged-in users and offline data
This is where most mature programs still fall short. When you know who the person is, the opt-out has to follow them, not just their browser.
Anonymous visitor
Apply the opt-out to that browser and any pseudonymous profile tied to it, such as a cookie ID or device ID. No need to ask who they are.
Logged-in user
Apply the opt-out to the account. That covers email audiences, offline sales and data shared from your CRM. Don’t ask them to opt back in for 12 months.
Known, not logged in
You may offer a simple way for them to identify themselves so the opt-out covers offline data. If they decline, still honor it for the browser.
Where a known user’s data usually keeps flowing
| Data flow | What to change |
|---|---|
| Customer-list audiences | Exclude opted-out accounts from hashed email uploads to ad platforms |
| Data co-ops and list rentals | Suppress opted-out records before every file transfer |
| Offline conversion uploads | Filter flagged customers out of store or call conversion feeds |
| Identity partners | Stop passing emails or IDs to identity graphs for opted-out users |
| App and web views | Carry the flag into apps that share the account |
The Lyft and Disney lesson
California’s 2026 settlements said the opt-out must be as easy as the service and must reach as far as the advertising does. If you link data across brands, devices and apps, the opt-out has to travel the same path.
The other opt-out channels
GPC covers people who send it. Everyone else still needs clear, easy ways to opt out, and regulators test those too.
“Do Not Sell or Share My Personal Information”
California requires this link (or the alternative “Your Privacy Choices” link and icon) in the footer of every page if you sell or share. Other states require a clear opt-out link for targeted ads and sale.
Opt-out request forms
Ask only for what you need to act. Don’t require an account, a password or identity verification. Honda paid in part for asking for too much information.
In-app opt-outs
If people use your app, the opt-out belongs in the app. Lyft’s settlement turned on a browser detour and a re-login.
Symmetric choices
If your banner offers “Accept all,” it must offer an equally easy way to say no. No extra clicks, no hidden toggles.
Your Privacy Choices
We use cookies and similar tools to show you ads on other sites, which some state laws treat as “selling” or “sharing” personal information. Turn this off below. If your browser sends a Global Privacy Control signal, we’ve already turned it off for this browser.
Opt out of sale, sharing and targeted advertising[toggle]. Signed in? We’ll apply your choice to your account too. Prefer email or phone? Contact [address] or [number].
What enforcement has taught us
Seven California actions, one theme: the opt-out existed, but it didn’t work the way the law requires.
| Company | Penalty | What went wrong | Lesson |
|---|---|---|---|
| Sephora AG · 2022 | $1.2M | Sold data through ad tags and didn’t process GPC signals. | Signals are opt-outs, not suggestions. |
| Honda CalPrivacy · 2025 | $632.5K | Asked for too much information to opt out; banner made accepting easier than declining. | No verification for opt-outs. Equal choices. |
| Todd Snyder CalPrivacy · 2025 | $345K | Misconfigured opt-out tool that failed for about 40 days; asked for excess information. | Test after every change. |
| Healthline AG · 2025 | $1.55M | Opt-outs that didn’t stop all tracking; shared sensitive article data with advertisers. | Check every tag, not just the CMP. |
| Tractor Supply CalPrivacy · 2025 | $1.35M | Didn’t honor opt-out signals or give proper notices, including to job applicants. | Signals apply across the business. |
| Disney AG · 2026 | $2.75M | Opt-outs didn’t extend across its services and devices. | The opt-out travels as far as the data. |
| Lyft AG · 2026 | $1.8M | No in-app opt-out; browser detour and re-login required. | Opt out where people use you. |
Pattern
None of these companies lacked a privacy policy. Every one had an opt-out that failed in practice. That’s what a test like page 8 finds.
Make sure partners hear it
Blocking your own tags is half the job. Partners that already received data, and platforms that receive it server-side, need to know about the opt-out too.
Signal the opt-out downstream
- IAB Global Privacy Platform (GPP): use a CMP that writes the US sections of the GPP string, including the GPC flag, so participating vendors receive it
- Platform settings: turn on restricted or limited data processing modes where ad platforms offer them, for flagged users
- Server-side APIs: pass the opt-out with each event, or don’t send the event
- Contracts: require partners to honor opt-outs you pass and to stop processing
Questions for your ad tech vendors
Under California law, sharing with a properly contracted service provider isn’t a sale. But many ad platforms act as third parties for cross-context advertising. If a vendor uses your data to target ads across other sites, treat it as sharing and stop it for opted-out users.
Most modern CMPs can output it with a setting change.
List every conversion API and confirm it checks the flag.
Add opt-out handling and no-resale terms at renewal.
Six weeks to January 1
A practical plan for marketing, engineering and privacy to work through together.
GPC-ready by January 1?
Tick each item only if you can show evidence for it.
Detect
Honor
Follow the person
Other channels
Prove it
Questions we hear most
If you use ad pixels or retargeting that share data with third parties for cross-context advertising, California treats that as sharing, and most states treat it as targeted advertising. That’s what the signal turns off.
You can, but it’s harder to get right and harder to prove. Honoring it everywhere is simpler and is what most businesses now do.
Not by itself. GPC is an opt-out of sale, sharing and targeted advertising. First-party analytics that don’t share data for advertising can usually continue, subject to other laws.
You don’t need to ask for anything. California’s draft rules would require showing whether the signal was honored, such as a short status message.
GPC is a browser signal, so apps don’t receive it directly. But apps still need their own opt-out, and a known user’s browser opt-out should follow them into the app.
Keep dated test results, network logs and screenshots, and log when your systems receive a signal and apply the opt-out.
Consent Mode adjusts how Google tags behave. It helps, but you still have to set the right consent state for GPC visitors and cover non-Google tags and server-side flows.
Glossary
Where this comes from
This guide draws on California’s CCPA and its regulations on opt-out preference signals, the Opt Me Out Act (AB 566), CalPrivacy’s draft amendments advanced on November 6, 2026, state privacy statutes requiring universal opt-out mechanisms, and published California enforcement actions.
The failure patterns reflect what we commonly find in website scans. Test results on your own site are what matter.
Information is current as of November 2026. State dates and draft rules change. This guide is general information and is not legal advice.
Captain Compliance honors GPC automatically, blocks tags before they fire, flags known users, and logs every choice so you can prove compliance.
Companion reading: The State of Privacy & AI Governance 2026–2027 and The ADMT & AI Notice Playbook.
See what your site
does with a GPC
signal.
Captain Compliance’s free scan shows every tag that fires for an opted-out visitor, so you can fix it before a regulator or plaintiff’s firm finds it.
Automatic GPC
Signals detected and honored before tags fire.
Every state covered
Opt-out links, forms and banners that meet each law.
Proof on file
Every choice logged, every scan saved.
captaincompliance.com
By Richart Ruddie, Founder & CEO
Not legal advice. Current as of November 2026.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
