Plain-English guides to the Global Privacy Control signal, California's opt-out rules, and what regulators have actually fined businesses for. Cited to oag.ca.gov, cppa.ca.gov, and the statutory text.
Global Privacy Control (GPC) is a one-bit signal a browser or extension sends with every request, saying: this person opts out of the sale and sharing of their personal information. Under California regulations it is not a courtesy — a business that sells or shares personal information must treat a GPC signal as a valid opt-out request, automatically, with no further user action.
The California Consumer Privacy Act, as amended by the CPRA, gives every California consumer the right to direct a business to stop selling or sharing their personal information. The obligations that flow from that right are specific, mechanical, and easy to get wrong — and the regulator has now shown it will fine businesses for getting them wrong.
California now has two active privacy enforcers: the Attorney General, who has brought CCPA actions since 2022, and the California Privacy Protection Agency, whose Enforcement Division began issuing its own decisions in 2025. The public record is small enough to read in full — and remarkably consistent about what gets you fined.
Honoring Global Privacy Control is not hard, but it fails in predictable places: the signal is read too late, the tag manager is configured to suppress cookies instead of blocking scripts, and the downstream advertising platforms never learn about the opt-out at all. Here is the implementation that actually holds up under a live audit.
California was first, but it is no longer alone. More than a dozen state comprehensive privacy laws now require businesses to honor a universal opt-out mechanism (UOOM) — and Global Privacy Control is the only mechanism that has actually been recognized by regulators. If you built your implementation as a California-only feature, it is already under-scoped.
Most teams believe that once they installed a consent management platform, opt-out compliance was handled. It usually was not. A cookie banner asks the visitor to make a choice on your terms; a GPC signal is a choice the visitor already made, arriving before your page renders. Conflating the two is the single most common finding in a GPC audit.
See whether your own site honors GPC. $99, runs in a real California browser.