Universal Opt-Out Mechanisms: GPC Is No Longer Just a California Problem

Updated 2026-08-05 · 2 enforcement actions cited · 4 official sources

California was first, but it is no longer alone. More than a dozen state comprehensive privacy laws now require businesses to honor a universal opt-out mechanism (UOOM) — and Global Privacy Control is the only mechanism that has actually been recognized by regulators. If you built your implementation as a California-only feature, it is already under-scoped.

TL;DR

California requires honoring opt-out preference signals under 11 CCR § 7025; GPC is the recognized signal.
Colorado maintains an official public list of recognized universal opt-out mechanisms; GPC is on it.
Connecticut, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland and others have UOOM obligations with staggered effective dates.
Scope differs by state: some cover targeted advertising and sale, others add profiling; some require honoring only for known residents.
Applying the signal globally is almost always simpler and cheaper than per-state gating.

See whether your own site honors GPC. $99, runs in a real California browser.

Why every new state law includes a UOOM clause

The drafting pattern is now standard. A state passes a comprehensive privacy law giving consumers the right to opt out of targeted advertising and the sale of personal data, and then adds a provision requiring controllers to honor an opt-out signal sent by a platform, technology, or mechanism on the consumer's behalf. Legislators learned from the Do Not Track failure that a right exercised one website at a time is not a right anyone actually exercises.

The practical result is that a single browser setting now carries legal weight in a majority of US states with comprehensive privacy statutes, with GPC being the only mechanism that has achieved regulator recognition at scale.

California

The CCPA regulations at 11 CCR § 7025 require businesses that sell or share personal information to process opt-out preference signals as valid opt-out requests. California does not maintain an approval list — the regulation describes the required characteristics of a compliant signal, and GPC meets them. The Sephora settlement confirmed enforcement.

California also uniquely requires that the signal be honored without additional user steps and without any penalty to the consumer.

Colorado

The Colorado Privacy Act took the most formal approach: the Attorney General maintains a public list of recognized universal opt-out mechanisms, and controllers must honor any mechanism on that list. Global Privacy Control was the first entry. Colorado's obligation covers targeted advertising and the sale of personal data.

Colorado's rules also address user-agent conflicts and default settings — a mechanism cannot be a default that the user never chose, which is why GPC implementations require an affirmative user toggle in most browsers.

Not sure where your site stands? Find out in a few minutes.

Connecticut, Texas, Oregon, Montana and the rest

Connecticut's CTDPA has required honoring universal opt-out mechanisms since January 2025. Texas's TDPSA requires it since January 2025 as well and has been actively enforced by the Texas AG. Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Maryland, and Minnesota all include UOOM obligations with dates staggered through 2025 and 2026.

The differences are mostly at the edges: whether profiling is in scope alongside targeted advertising and sale, whether the controller must honor the signal only for consumers it knows to be state residents, and whether the state maintains a formal recognition list. None of these differences make a global implementation wrong — they only make a California-only implementation insufficient.

The practical recommendation

Do not build state-gated GPC handling. Geolocation of web traffic is imperfect, VPN and mobile-carrier IP allocation routinely misattributes state, and the operational cost of maintaining a per-state matrix of which signal maps to which data-use restriction exceeds the marginal advertising revenue from the tiny slice of GPC-sending traffic you would otherwise keep monetizing.

Honor the signal globally, propagate the opt-out downstream once, and document that you do. That single decision satisfies every state UOOM obligation simultaneously and is far easier to defend.

Key enforcement actions

Colorado AG — Universal Opt-Out Mechanism list

Colo. Dep't of Law, recognized-mechanism list

Colorado is the only state that formally publishes a list of recognized universal opt-out mechanisms. Global Privacy Control was the first mechanism added, giving it explicit regulatory recognition outside California.

Read the official source ↗

People v. Sephora USA, Inc.

Cal. Att'y Gen., Aug. 2022, $1,200,000

The precedent every other state's regulator now points to when explaining that a universal opt-out mechanism creates a real, enforceable obligation.

Read the official source ↗

FAQ

Is GPC recognized in every state that has a UOOM requirement?

Most states describe required characteristics rather than naming a specific mechanism, and GPC meets those characteristics. Colorado formally lists it. No state regulator has rejected it.

Do I have to detect which state the visitor is in?

Some statutes limit the obligation to consumers the controller knows are residents. In practice, honoring the signal for everyone is simpler and avoids geolocation error entirely.

Does the EU's GDPR recognize GPC?

Not as a formal mechanism. GDPR requires opt-in consent for most tracking, which is a stricter default than GPC provides. Honoring GPC does not substitute for a GDPR-valid consent flow in the EEA and UK.

What about profiling opt-outs?

Several states extend the opt-out right to profiling in furtherance of decisions producing legal or similarly significant effects. Where a UOOM covers profiling, the signal must suppress that processing too — worth checking against your personalization and scoring systems, not just your ad tags.

Official sources

US state privacy legislation tracker ↗— IAPP
Colorado Privacy Act resources ↗— Colorado Attorney General
CCPA Regulations § 7025 ↗— California Privacy Protection Agency
Global Privacy Control specification ↗— GPC Working Group