Universal Opt-Out and GPC: State Requirements Compared

Executive Summary

Universal opt-out mechanisms (UOOMs) let consumers opt out of sale and targeted advertising once, at the browser or device level; Global Privacy Control is the dominant implementation.
California requires honoring GPC now (confirmed by the Sephora action); Colorado mandates recognized UOOMs since July 1, 2024, with GPC on its official shortlist; Texas, Connecticut, Oregon, Montana, Delaware, New Jersey, and more have their own effective dates.
The signal must be treated as a valid consumer request: suppress selling/sharing/targeted-ad flows for that browser, and where the user is known, apply it to the account.
Enforcement is trivially easy for regulators: enable GPC, load the site, watch the ad calls, which is why signal-ignoring is the most commonly charged violation in California actions.
Implementation is an edge concern: read the Sec-GPC header and navigator.globalPrivacyControl, bind it into consent state, and propagate to client-side tags, server-side containers, and platform restricted-processing flags.

The universal opt-out is US privacy law’s answer to opt-out fatigue: if every site must offer an opt-out, let the browser say it once for all of them. GPC went from activist proposal to legal mandate in three years, Sephora made ignoring it a California violation, Colorado formalized a recognized-mechanism list, and the Virginia-lineage states added mandates in waves. For businesses, the strategic fact is asymmetry: honoring GPC everywhere costs one engineering sprint; honoring it selectively requires per-state legal gating that fails audits.

Signal	Global Privacy Control (Sec-GPC / navigator API)
Mandating states	CA, CO, CT, TX, OR, MT, DE, NJ (+ growing)
Colorado list	AG-recognized UOOMs (GPC included) since July 2024
First enforcement	Sephora, $1.2M (CA AG, 2022)

The implementation blueprint

Edge intake. Read Sec-GPC at the CDN and expose it to the application; read navigator.globalPrivacyControl in the consent layer before any tag executes. Race conditions where tags fire before consent state resolves are the top real-world failure.

One consent state, all pipelines. The signal must gate client-side tags, server-side containers (a growing blind spot), mobile app SDK behavior where linked, and batch flows like audience uploads. Wire it into the same state machine as Do Not Sell clicks so downstream propagation is shared.

Account binding. On login, merge browser-level opt-outs into the consumer record and apply across devices per state rules. Keep timestamps and provenance; Colorado’s rules contemplate conflicts between signals and prior consent, resolved in favor of the most recent expression.

Evidence. Log signal receipt, state changes, suppression effects, and third-party notifications. When a regulator’s test browser sends GPC and sees a quiet network tab, you pass; the logs prove the pattern held historically.

State-by-state specifics live in the state comparison and multi-state strategy guides. To find out today whether your site keeps calling ad platforms after a GPC signal, run a free scan.

Frequently Asked Questions

Which states require honoring GPC today?

California (CCPA regulations; enforced since Sephora, 2022) and Colorado (recognized-UOOM mandate since July 1, 2024) are the anchors. Connecticut's mandate began January 1, 2025; Texas from January 1, 2025 and Oregon from January 1, 2026; Montana from January 1, 2025; Delaware and New Jersey phase in through 2025-2026; more follow with each legislative cycle. Virginia and Utah, notably, have no UOOM mandate. Treating GPC as national policy is simpler and safer than per-state gating.

What exactly must happen when a GPC signal arrives?

Treat it as an opt-out of sale/sharing (California) and of sale/targeted advertising (Colorado-lineage states) for that browser: stop identifier-bearing calls to third-party ad platforms, flip platform flags like RDP/LDU for that user, and record the state. If the visitor is authenticated or later authenticates, states expect the opt-out to attach to the consumer, not just the cookie jar. A banner asking them to confirm the opt-out is friction regulators have criticized; process it silently.

Can we ask GPC users to make an exception for us?

You may present a neutral opportunity to consent to sale/sharing despite the signal (California allows asking), but you cannot condition service, nag repeatedly, or default them back in. Colorado similarly permits authenticated consent to override a UOOM, logged and revocable. Dark-pattern overrides convert a compliance feature into an enforcement exhibit.

How do we detect the signal technically?

Two surfaces: the Sec-GPC: 1 HTTP request header (readable at CDN/edge or origin) and the navigator.globalPrivacyControl JavaScript property (readable by your CMP before tags fire). Robust implementations read both, set the consent state before the tag manager initializes, mirror the state into server-side tagging containers, and log signal receipt for audit. Test with Firefox (native), Brave (default-on), or the GPC browser extensions.

Does honoring GPC replace the Do Not Sell link?

No, in California you need both the homepage link (or the Your Privacy Choices pattern) and signal processing; the CPPA treats the frictionless-signal route as a condition for slightly simplified link options, not a replacement for opt-out rights. Other states likewise keep the webpage opt-out method alongside the UOOM mandate. Think of GPC as one intake channel in a multi-channel opt-out system.

Regulatory Crosswalk

GPCCCPAColorado CPAState opt-out laws

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert